Site-to-site VPN
Troubleshooting
This page is for the IT administrator whose tunnel is not behaving. Start with the status badge at the top right of Network, Site-to-site VPN, then the message beneath it.
The status badge
Section titled “The status badge”| Badge | Meaning | What to do |
|---|---|---|
| Connected · time | The tunnel is up and has been for the time shown. | Nothing. If hosts are still unreachable, see Connection tests. |
| Not connected | The gateway has your settings but the tunnel is not established. | Read the message under the badge and the Gateway log. |
| Not set up yet | The gateway has no tunnel for this connection. | Complete Your side and click Save and connect. |
| Checking… | The portal has not yet heard from the gateway since you opened the page. | Wait for the next refresh, or click Refresh status. |
Messages under the badge
Section titled “Messages under the badge”What you see
Tunnel configured but not established
What it means
The gateway has your settings and is trying to connect, and your firewall has not completed the negotiation.
What to do
- Confirm your firewall has the values from Settings for your firewall: our public IP address, our internal networks and the current pre-shared key.
- Confirm your firewall accepts IKE from our public IP address, and that Your public IP address on the Connection tab is the address your firewall actually uses.
- Open the Gateway log. The entry tells you whether the problem is the key, the proposals or the networks.
What you see
No IPsec configuration on the gateway
What it means
Nothing has been applied to the gateway yet.
What to do
Click Save and connect on the Connection tab. If Applying your changes to the gateway stays for more than a few minutes, contact your account manager.
What you see
Could not reach the gateway
What it means
The agent beside your gateway could not read its state on the last poll.
What to do
Wait for the next refresh. If it persists, contact your account manager.
Applying your changes to the gateway
Section titled “Applying your changes to the gateway”The banner shows after every save and after generating a key, until the agent confirms it has written the settings to the gateway. The agent polls every 30 seconds. The banner clears only when every required value is present: your public IP address, at least one office network, and a pre-shared key. If it stays, check that all three are set, then contact your account manager.
Messages on the Connection tab
Section titled “Messages on the Connection tab”| Message | What to do |
|---|---|
| Please correct the highlighted values | Read the list in red above the fields. See Your side. |
| Could not save your settings | The portal could not reach the VPN service. Try again shortly. |
| No key yet — generate one below. | Click Generate key, then enter the key on your firewall. |
| Could not retrieve the key | The key could not be revealed. Refresh the page and try again. |
| A connection with that name already exists. | Choose another name. |
| That connection no longer exists. Refresh the page. | The connection was removed. Refresh to see the current list. |
| Your session has expired. Sign in again. | Sign in to the portal again. |
| Too many requests. Wait a moment and try again. | Wait, then retry. |
| The VPN service is not responding. Try again shortly. | Retry in a few minutes. If it persists, contact your account manager. |
| Could not reach the portal. Check your connection and try again. | Your own internet connection to the portal dropped. |
Messages on the Diagnostics tab
Section titled “Messages on the Diagnostics tab”| Message | What to do |
|---|---|
| Enter an IPv4 address on your network | Type an address such as 192.168.10.5. Host names are not accepted. |
| … is not inside your configured networks (…) | The address must be inside one of your office networks. Add the network on the Connection tab first. |
| Port must be between 1 and 65535 | Correct the port. |
| A test is already running | Wait for the current test to finish. |
| No response through the tunnel | See If a test fails. |
| Gateway has no address in the tunnel network | Contact your account manager. |
The tunnel drops and comes back
Section titled “The tunnel drops and comes back”Dead peer detection runs every 30 seconds with a 120 second timeout. When your firewall stops answering, the gateway restarts the tunnel on its own; the Connected for figure on the Traffic tab resets. A tunnel that drops at the same time each day usually follows a scheduled restart or a key lifetime set on your firewall; the gateway’s Phase 2 lifetime is 3600 seconds, and the two sides renew keys independently without dropping traffic.
If this does not resolve it, contact your account manager with the connection name, the time, and the lines from your firewall’s VPN log for that time.