Recover VPN Tunnels

1. Verify the WAN circuit from the branch to the data center is up.
2. Confirm that the external NAT addresses configured on the WAN ports are correct on both sides, and that no firewall or NAT policy in the path between the two ION devices is blocking UDP ports 500 and 4500.
3. Go to IncidentsPrisma SD-WAN and check incidents for any VPN alarms and note the reported cause.
4. Verify the VPN daemon process is running:

   debug process status name=vpnd

   Expected output shows RUNNING with a stable uptime. If the process is stopped or shows a very recent start time, escalate to Palo Alto Networks support before continuing.
5. Check BFD keepalive exchanges on the WAN interface (physical, subinterface, or VLAN). Replace <interface-number> with your WAN interface number:

   tcpdump <interface-number> args="port 3784" show

   Healthy output shows bidirectional BFD packets arriving at a regular interval from both WAN interfaces. Traffic appearing in only one direction, or no traffic at all, indicates a path issue between the two endpoints.
6. If BFD is healthy, verify that ESP packets are flowing after the VPN forms. Replace <interface-number> with your WAN interface number:

   tcpdump <interface-number> args="esp" show

7. Check VPN tunnel status across all sites:

   dump vpn ha all

   For each tunnel, confirm status: Up, usable: true, and active: true. In an HA deployment, expect one active tunnel (active: true, usable: true) to the active peer ION device, and one inactive tunnel (active: false, usable: false) to the backup peer ION device on the remote side.
8. Verify VPN shared secrets are current. Use the vep_id value from the dump vpn ha all output from the active site and target site:

   dump vpn sharedsecret VpnID=<vep-id>

   The output shows three 24-hour secret windows. Confirm that at least one window covers the current date and time. Shared secrets are auto-rotated by the platform.
9. Check VPN keepalive state per peer site:

   dump vpn ka all

   Confirm state=UP for the expected peer sites.
10. Detach and re-attach the circuit on the interface to re-trigger VPN creation as the last option to troubleshoot. This should be done under Palo Alto Networks support supervision. To re-attach the circuit, select ConfigurationPrisma SD-WANION DevicesDevice ConfigurationInterfaces, then remove and re-add the circuit label on the affected interface. The operation completes in a couple of seconds; tunnels reform within two to three seconds.

    This is a highly disruptive operation with multiple potential side effects. Do not perform this step without Palo Alto Networks support supervision.