Contents

Introduction

Problem

Troubleshoot

Introduction

This document describes how to troubleshoot network tunnels showing as inactive on the Umbrella Dashboard.

Problem

After adding network tunnels, the tunnels appear on the Umbrella Dashboard as inactive.

Troubleshoot

1. Enable logging for the default Cloud-Delivered Firewall (CDFW) policy to activate network tunnels. Your network tunnels only show as "active" if logging for the default Cloud-Delivered Firewall (CDFW) policy is enabled:

360062629451

2. If logging is enabled, run this command on the router where the network tunnels are configured:

show crypto ikev2 sa

Ensure that the source IP address is an internal IP address from the user network as per RFC 1918. Check your configuration according to this guide: Network Tunnel Configuration. If the error continues, please create a ticket with the show crypto ikev2 sa command along with the CDFW logs to our Support Team for assistance.