FMC displays working IKEv2 tunnel DOWN

[swscco001]

Hello everybody,

our customer is using FMCv 7.2.5.1 and (two) Firepower 1120 (7.0.0.1)
for their S2S tunnels (see screen dump).

We changed a IKEv1 to IKEv2 tunnel (peer-IP 217.6.229.234).

In the VPN > Site To Site overview this working tunnel was displayed as
DOWN (see screen dump).

In the VPN > Site To Site Monitoring the tunnel is correctly displayed
as UP witn active sessions (see screen dump).

In the VPN > Site To Site there is no error message for this tunnel
(see screen dump).

What is the reason for this wrong indication in the Site To Site overview.
The customer feels unsave at such indication because there is a hospital
connected.

This seems to be a general issue becasue other working tunnels were
indicated ar orange.

Thanks a lot for every hint.

Bye
Rene

[MHM Cisco World]

Can I see exactly the error message 

MHM

[MHM Cisco World]

I dont see issue'

You meaning SA delete issue?

It s2s ikev2 so there is child sa which add or remove.

Check this point' access to ftd and see sa use currently for specific subnet' if there is no sa then there is issue if there is new child sa then it normal.

MHM

[swscco001]

Hi MHM,

it's weired for the customer to see orange and red IKEv1- and IKEv2-tunnels even is the partners can
communicate over these tunnels without problems and the site-to-site monitoring displays green
operation status.

Is there a document how to troubleshoot such issues?

Thanks a lot!



Bye
R.

[MHM Cisco World]

Hi
https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/vpn-s2s.html

the only point left is under the Tunnel status Distribution do you config VPN using ISP backup or not ?
MHM

[swscco001]

Hi MHM,

I wish you a Happy New Year!

We did not configure a ISP backup for the tunnels.

In der given link I did read the following:

• Tunnel Status Table—A table listing the site to site VPNs configured using the FMC

• Tunnel Status Distribution Chart—Aggregated status of the tunnels in a donut graph.

It is misleading if functioning tunnels are displayed in orange or red (DOWN) under
"Tunnel Status Distribution".

The customer asked: What is the difference between the VPN > Site To Site "Tunnel Status Distribution"
and the VPN > Site To Site Monitoring "Status"?

Thanks a lot!



R.

[MHM Cisco World]

thanks alot
Happy new  year friend 

regarding tunnel issue can I see the config of tunnel 
MHM 

[Marvin Rhoads]

I have seen some inconsistent displays myself on a customer's FMC 7.4.1 - tunnel status shows no active data while VPN is up and passing data.

I've opened a TAC case just today and am waiting for the engineer to provide assistance.

[swscco001]

Hi Marvin,

a Happy New Year for you!

Seems that this is a cosmetic bug of several FMC releases.

Do you already have any reply from the TAC?

Thanks a lot!



Bye
R.

[Marvin Rhoads]

My TAC case has been referred to the developers. The TAC engineer had initially thought a resolved bug related to the old VPN monitoring page might apply but it did not. So at this point we are waiting on the developers to reply.

[Danny Dulin]

Hi Marvin.

Did you ever get a resolution to this? I just upgraded FMC to 7.2.9 and experiencing the same issue. Traffic is passing without issue, but FMC shows Tunnel Inactive.

[Marvin Rhoads]

@Danny Dulin  There ended up being a couple of issues. One was to make sure that the Health Monitoring policy for VPN is enabled. (System > Health Policy > Edit > VPN > VPN Statistics) This is a newer option that may get deselected across an upgrade.

[Danny Dulin]

Thanks Marvin, but that wasn't the issue.

[Marvin Rhoads]

One other thing the TAC advised trying was to make a minor change in the VPN topology (e.g. add a character to the topology name) - just enough to trigger an pending deployment. Then deploy the change to "force" the endpoint(s) to start sending the requisite logs.

[Danny Dulin]

Thank you.

Was your tunnels working despite the GUI show otherwise?