🔐 Palo Alto Networks Tunnel Monitoring

Tunnel monitoring in Palo Alto Networks firewalls ensures the reliability and availability of IPSec VPN tunnels. It works by sending ICMP probes (pings) to a specified destination IP address across the tunnel. If the destination becomes unreachable, the firewall can take predefined actions such as waiting for recovery or failing over to a backup path. This mechanism is crucial for maintaining uninterrupted VPN services and for detecting issues that traditional Dead Peer Detection (DPD) might not catch.

📈 Flow Diagram: Tunnel Monitoring Process

flowchart TD A[Start: Tunnel Monitoring Enabled] --> B{Is Destination Reachable?} B -- Yes --> C[Continue Monitoring] B -- No --> D{Monitor Profile Action} D -- Wait Recover --> E[Log Event and Continue Probing] D -- Fail Over --> F[Disable Tunnel Interface] F --> G[Routing Table Updated] G --> H[Traffic Routed via Backup Tunnel] E --> C

🔄 Sequence Diagram: Tunnel Monitoring and Failover

sequenceDiagram participant Firewall participant Destination Firewall->>Destination: Send ICMP Probe alt Destination Responds Destination-->>Firewall: ICMP Reply Firewall->>Firewall: Reset Probe Counter else No Response Firewall->>Firewall: Increment Probe Loss Counter alt Probe Loss Threshold Reached Firewall->>Firewall: Execute Monitor Profile Action alt Action: Wait Recover Firewall->>Firewall: Log Event and Continue Probing else Action: Fail Over Firewall->>Firewall: Disable Tunnel Interface Firewall->>Routing: Update Routing Table Routing->>Firewall: Route Traffic via Backup Tunnel end end end

📌 Key Points