Active / Active HA IPsec tunnel setup.

zGomez — Wed, 19 Apr 2023 13:24:33 GMT

Hi,

We have an Active/ Active firewall between 2 datacenters. We have configured a single tunnel on a floating IP that is Active in Datacenter A to a remote Partner. Firewall in DC A is currently in Active Secondary State, Firewall in DC B is currently in Active Primary state.

The tunnel has both phases up on the firewall in DC A and only the phase 2 on firewall in DC B (expected behaviour).

There is no VR sync configured between firewall in DC A and DC B option is not configured.

Both firewalls have static routes configured to the destination over tunnel.6.

The green line is the working scenario, user logon to citrix farm in DC A(172.25.0.0/24), the application is reachable over the tunnel 6

The red line is the non working scenario, user logon to citrix farm in DC B (172.25.3.0/4), the application doesn't work because I believe it it tryin to send it over the tunnel on firewall DC B that is not fully established. (only phase 2).

The orange line is what I would like it to do based on session ownership, sessions setup for the tunnel.

My question is is the behaviour i am seeing expected behaviour or should it work like the orange line?

Re: Active / Active HA IPsec tunnel setup.

reaper — Mon, 08 May 2023 09:02:02 GMT

That's expected behavior

the orange line would only come into play on 'returning' packets where a session's packets are returned to a session owner rather than a routing option. For the A/A to allow full routing you'd need a (functional) tunnel on each member so packets can be sent out organically and then have A/A packet ownership use HA3 to 'fix' sessions on the session owner firewall for packet inspection

i.e. have 2 fully functional tunnels, syn goes out of B, ACK comes back through A, HA3 is used to pass ACK packet to B for session creation/inspection

topic Active / Active HA IPsec tunnel setup. in General Topics

Active / Active HA IPsec tunnel setup.

Re: Active / Active HA IPsec tunnel setup.