Synopsis

Required License

Details

Correlated Alerts

• AL_RN_ECMP_PROXY_TUNNEL_DOWN

Remediation

1. Check for any resource utilization issues on the device where this tunnel terminates.
2. If there are any in-path devices prior to the terminating device, check for any resource utilization issues there, as well.
3. Perform a ping and traceroute to check for any latency inconsistencies or packet loss between the site and Prisma Access location.
4. Contact your ISP in case of packet loss. If there is no packet loss or results are inconclusive:
   1. Isolate some test traffic and perform packet captures.
   2. Check for any TCPs that are out of order, lost segments, or retransmission, which might indicate packet loss through the tunnel.
   3. If you observe these issues, take packet captures of the ESP traffic, so you can check the public IP addresses between the Prisma Access location service IP address and the remote VPN peer IP address.
   4. Review for gaps in the ESP sequence numbers, which indicates in-path packet loss, or out-of-order ESP sequence numbers, which indicate reordering by a network device in the path.
   5. If there are other network devices in the path prior to the terminating device, perform steps a through d to help isolate the problematic network device.
5. Contact your ISP to check for any issues at the remote site.
6. If these steps don't help you resolve your issue, contact the Palo Alto Networks Customer Support Portal.