Standard VPN Tunnels flapping on ION devices

• Standard VPN (3rd party VPN) tunnels keep flapping.
• During an IKE rekey session,  multiple_ike_session event are created  causing  the standard VPNs to flap.
• Interface down status under "Alarms" display "multiple_ike_session" and reason as "down"

• The above information can be confirmed in the CLI as well

debug logs dump tunnelmgr | grep "yyyy-mm-dd"
14:01:54.872 inf tunnelmgr  4430   tunnelmgr             SetServiceLinkStatus sl:sl1, state:{extended_state:multiple_ike_session, local_ip:64.129.x.x, remote_ip:4.x.x.x, state:down}
14:02:33.872 inf tunnelmgr  4430   tunnelmgr             SetServiceLinkStatus sl:sl1, state:{extended_state:multiple_ike_session, local_ip:64.129.x.x, remote_ip:4.x.x.x, state:down}

• The following command display e "Extended State : multiple_ike_session"

dump servicelink summary all
dump interface status <interface>
dump servicelink summary slname=<name of the tunnel>

• Prisma SD-WAN
• ION devices
• VPN
  
  

• Both ends of the VPN tunnels are in active mode.
• The active mode is enabled on the other side of the tunnel interface as well.

1. While building a IPSec tunnel, Enable passive mode on the other side of the tunnel interface.
2. The endpoint should be configured as passive/responder only.
3. Change the mode from active to passive on the remote end (i.e on the vendor) for the tunnels to come up.