I am creating a site to site VPN from Azure to company headquarters. The Connection comes up fine, but is dropped after exactly 1 hour. In the Palo Alto logs we can see a timeout value of 3600 secs, which is the default for Policy Based VPN Gateways. We are using a Route Based VPN Gateway (using BGP), which should have a timeout value of 27,000 secs according to https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices#ipsec If we reset the Virtual Network Gateway, the VPN comes up again for exactly an hour. Any ideas how to resolve this?


Try troubleshooting with Network Watcher and see if you can get any logs from your gateway .


If that doesn’t help triple check the configuration of both sides.

  • Thanks Jarnstrom good suggestions. Unfortunately we are hitting a bug with Network Watcher where it doesn't capture the correct logs (my colleague has a case open with MS on this for another customer!). What's odd is that a test vpn to another subscription is working fine with the same settings. That's showing a different sa lifetime value in the PA logs, but was done via the portal rather than with an ARM template, but template has no extra settings in it! – Wayno May 4 at 8:47
  • @Wayno that’s weird. Could it be that the ARM template targets an older API version? – Jarnstrom May 5 at 20:50
  • That's a great thought @jarnstrom. I am using an older version of the API in the template, that's worth a try – Wayno May 8 at 2:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.