"Handling event from device" Then VPN goes down

[jespada11]

Hello, We have a policy-based VPN to a third party that randomly goes down briefly, but after it comes back up, we still lose messages for 15-20 minutes. Each side says they have no touched the config since it was created years ago. We got on a call and varied are settings matched.

Environment:

Virtual Cisco FTD in Azure
Managed by CDO (not on-premises FMC)
Multiple tunnels to same third-party (some locations fail, others don't simultaneously)

Symptoms:

Random failures (no time pattern - sometimes hours apart, sometimes days)
Tunnel goes down for less than a second, then comes back up
But messages are lost for 15-20 minutes after tunnel recovery
Logs show: "Handling event from device: [my FTD device ID]" followed by "reason => 'Lost Service'"

Question: How can I determine what specific event triggers the "Handling event" message? The logs don't show the root cause - just that my FTD initiated the teardown with generic reasons.

[MHM Cisco World]

Sorry can you elaborate 

MHM

[jespada11]

Elaborate in what way? What information do you need that you think is missing?

[jespada11]

I am trying to figure out if there is anything I can do to get more information on what the "Handling event from device" that is seen which is then followed by our VPN tunnel going down is and lost service. 

These are very generic and I cant get down to a fixable root cause. 

[MHM Cisco World]

$$Handling event from device: [my FTD device ID]$$

This mean less' it only start of event' it appear in any event' like timestamp in log.

I need to know exact event.

Also you run VTI with zscaler?

VTI down only when tunnel source and/or tunnel destination is down.

MHM

[Sheraz.Salim]

as you running policy based vpn. could be the remote side have issue with internet connectivity? how many other vpn tunnel with this remote side you have?

as your FTD on clould unlikely your coluld haivng issues its more likely the remote end have something to do with.

have you asked the remote side to get the confirmation from there service provide there is no outrage?

"Lost Service" means when you lost the connection with remote vpn-tunnel.

you may configure the capture on your FTD at LINA. it might give you some where starting point to start looking where the problem is

Connnect to FTD cli

system support diagnostic-cli
!
capture ike_cap type isakmp interface outside match ip host 1.1.1.1 host 8.8.8.8

 I think you can do this from CDO too. But i have not used so no idea how to set this up.