Stable VPNs to Palo Altos

Question

I am trying to get a stable VPN between a Palo Alto and a WR31.
The Palo Alto is the initator and the WR31 is the Peer.
I can get the VPN to come up. However, it remains stable for up to an hour. The WR31 drops the VPN and the Palo alto thinks it is still up.
I have contacted Digi and Palo Alto tech support. We have been at it for over a week and the issue has still not been resolved.
Has anyone else in the world done this? What is the secret?

Answer 1

Hi and welcome to Digi Forums.

We do have other customers using our devices with Palo Altos successfully. (most of the time we are actually the initiator rather than the responder but that should not have any impact)

There are several things that can affect a tunnel behavior as well as several configuration options that could help to rebuild it, for example:

eroute n autosa 0
eroute n nosa drop
ike 0 delmode 3

If you are already in contact with our Support Team, I would suggest to continue working with them via our case/mail system as this is the right place for such troubleshooting.

If you did not reach out to the Support yet, please send a mail with all details at tech.support@digi.com
You can view all details about our support and support policies here: https://www.digi.com/support

Thank you

Regards

Alex
Digi Technical Support

Comments

Thank You. I have contacted digi tech support. However, we don't seem to be addressing the issue. The VPN is dropping on the digi side. Can you translate those three commands for me? Is there a master list so when I look at the text config I can tell what I am looking at?

---

Hi,

You can find details about all our commands (and their corresponding GUI alternatives) in our user guide: https://www.digi.com/resources/documentation/digidocs/90001019/default.htm

Regards

Alex
Digi Technical Support