site-to-site VPN between Meraki and Palo Alto

[Phi1001]

We have an ikev1 site-to-site VPN between client's Meraki and our Palo ALto.

The issue is as follows :

The VPN goes down after the phase 2 lifetime expires and doesn't renegotiate on its own.

It only comes up when the traffic is initiated from Meraki's side and remains active until the pings from Meraki are going on.

Please advise. How do we fix this issue.

[ww]

https://docs.sse.cisco.com/sse-user-guide/docs/manual-meraki-mx#caveats-considerations

[Main10ence]

Hello @Phi1001,

I've heard of customers leveraging free applications (like DataDog) to ping across the tunnel are certain intervals to keep the tunnel up. 

If you are REALLY fancy, you could use a CRON job that sends out pings at or during times when traffic is minimal. 

[Phi1001]

Thanks Sir.

[BrandonD]

Hi @Phi1001,

Thanks for the post :). I can confirm this is indeed expected behavior for our Non-Meraki VPN peers as outlined below:

• https://documentation.meraki.com/MX/Site-to-site_VPN/Troubleshooting_Non-Meraki_Site-to-site_VPN_Pee...
  
  • You must generate Interesting Traffic in order to bring the tunnel up. You can do it by initiating a ping from a host inside a VPN enabled subnet into an IP address in the remote subnet.

As some of the other members have noted this can be done with 3rd party tools, or live data within your environment, whichever best serves your environment! 

[Phi1001]

Thank You, Sir.

I'll try that.

[alemabrahao]

Check the tunnel lifetime configuration.

IPsec VPN Lifetimes - Cisco Meraki Documentation

[Phi1001]

Thanks for the information.

Currently, phase 1 lifetime is set to 28800 seconds for phase 1 and 3600 seconds for phase 2.

But, as per your article, both lifetimes are set to 28800 by default. I will change the phase 2 lifetime to 28800 seconds and try again.