Site to site VPN between Cisco router and Palo alto

[MriduD]

we have a policy-based site-to-site VPN between cisco router and palo alto. But the tunnel goes down and doesn't come up after the IPsec lifetime is expired. And tunnel only comes up after sending traffic from cisco to palo alto and not the other way. When The devices under the Cisco LAN subnet(192.168.2.0/24) try to communicate with the server (under the PA LAN subnet, 10.1.1.0/24), the tunnel doesn't come up. DPD and lifetime are already configured on both the Cisco router and PA.

[MHM Cisco World · Accepted solution]

No need to config Router as redponder

Also you need one more command 

Ip sla schedule <ip sla number> life forever start now

[MriduD]

@MHM Cisco World  Is this how we have configured the values as default? Or should I not configure anything and it will take the default values?

[MHM Cisco World]

As I mention, if you dont config anything the ip sla will use default value.

No need to change it 

MHM

[MriduD]

Tunnels have been stable so far after configuring ip sla on the Cisco side

[paul driver]

Hello
As far as i am aware the PA's do not support  IPSLA however they do allow tunnel monitoring which you can enable on the creation of the tunnel as/when you add your ike/ipsec crypto profiles.
Optionally  you can use its default network monitor profile or create a new one. -->here

[MriduD]

Thank you for your input, Sir.

I am going to configure IP sla on the cisco router since the clients are behind the cisco router. I shall let you know if it doesn't work.

[paul driver]

Hello
re-reading this OP
This is not down to any ipsla monitoring or the lack of it- it down to how to dynamically bring up the tunnel as/when if it ever failed or if interesting traffic is initiated or not

Can elaborate on the PA side of things regards the vpn creation -ike/ipsec profiles and if the tunnel is statically addressed or not 

[MriduD]

Do you want to look at the configuration on the PA side?

[paul driver]

Hello
can you share (in a file)
sh vpn tunnel
sh vpn gateway
sh vpn flow
sh vpn flow name xx
sh vpn ike-sa detail gateway xx
sh vpn ipsec-sa tunnel x
sh vpn ipsec-sa sum

[MriduD]

Hello sir,

Actually, i configured ip sla on the Cisco side... Tunnels look stable now . I would still keep an eye on the connectivity. If they do down again, I shall let u know. Ok?