Focus

Prisma Access

INC_RN_ECMP_TUNNEL_FLAP

Table of Contents

Filter

Expand All | Collapse All

Learn about the INC_RN_ECMP_TUNNEL_FLAP incident.

Synopsis

The remote network ECMP tunnel is flapping.

Incident Code—INC_RN_ECMP_TUNNEL_FLAP

Severity—Warning

For details about incident severity, see Incidents Distribution Over Time in Incidents and Alerts Overview.

Prisma Access


Raise condition	The tunnel flapped at least 5 times in 10 minutes.
Clear condition	The tunnel has been up for at least 8 minutes.

Check for any resource utilization issues on the device where this tunnel terminates.
If there are any in-path devices prior to the terminating device, check for any resource utilization issues there, as well.
Perform a ping and traceroute to check for any latency inconsistencies or packet loss between the site and Prisma Access location.
Contact your ISP in case of packet loss. If there is no packet loss or results are inconclusive:
1. Isolate some test traffic and perform packet captures.
2. Check for any TCPs that are out of order, lost segments, or retransmission, which might indicate packet loss through the tunnel.
3. If you observe these issues, take packet captures of the ESP traffic, so you can check the public IP addresses between the Prisma Access location service IP address and the remote VPN peer IP address.
4. Review for gaps in the ESP sequence numbers, which indicates in-path packet loss, or out-of-order ESP sequence numbers, which indicate reordering by a network device in the path.
5. If there are other network devices in the path prior to the terminating device, perform steps a through d to help isolate the problematic network device.
Contact your ISP to check for any issues at the remote site.
If these steps don't help you resolve your issue, contact the Palo Alto Networks Customer Support Portal.