INC_RN_SECONDARY_WAN_TUNNEL_DOWN

Table of Contents

Filter

Expand All | Collapse All

Learn about the INC_RN_SECONDARY_WAN_TUNNEL_DOWN incident.

Synopsis

Remote network site <site-name> secondary WAN tunnel <tunnel-name> is down.

Incident Code—INC_RN_SECONDARY_WAN_TUNNEL_DOWN

Prisma Access


Impact	The remote network user count when the tunnel went down (does not increase or decrease when the incident is in the raised state).
Raise condition	The tunnel is down for at least 10 minutes.
Clear condition	The tunnel is up for at least 8 minutes.

Check for any resource utilization issues on the device where this tunnel terminates.
If there are any in-path devices prior to the terminating device, check for any resource utilization issues there, as well.
Perform a ping and traceroute to check for any latency inconsistencies or packet loss between the site and Prisma Access location.
Contact your ISP in case of packet loss. If there is no packet loss or results are inconclusive:
1. Isolate some test traffic and perform packet captures.
2. Check for any TCPs that are out of order, lost segments, or retransmission, which might indicate packet loss through the tunnel.
3. If you observe these issues, take packet captures of the ESP traffic, so you can see the public IP addresses between the Prisma Access location service IP address and the remote VPN peer IP address.
4. Review for gaps in the ESP sequence numbers, which indicates in-path packet loss, or out-of-order ESP sequence numbers, which indicate reordering by a network device in the path.
5. If there are other network devices in the path prior to the terminating device, perform steps a through d to help isolate the problematic network device.
Contact your ISP to check for any issues at the remote site.
If these steps don't help you resolve your issue, contact the Palo Alto Networks Customer Support Portal.