topic Re: IKEv2 tunnel does not restore after HA failover in General Topics

IKEv2 tunnel does not restore after HA failover

MikeSchrader — Fri, 02 Jun 2023 13:31:24 GMT

I have an IKEv2 IPSec tunnel that does not automatically restore after an HA failover. Once the IKE-SA and IPSec-SA is manually cleared, the tunnel eventually restores. I have other IKEv2 tunnels that restore after several minutes with no intervention.

The VPN is configured to a GRE router so the only application I'm seeing on the session is "gre" and no ipsec-esp or ike. Once IKE and IPsec are manually cleared, I show ipsec-esp, ike along with the original gre application. Is there a setting or work around to automatically restore the tunnel after the failover?

Re: IKEv2 tunnel does not restore after HA failover

BPry — Fri, 02 Jun 2023 14:37:49 GMT

@MikeSchrader

This is a pretty common thing. I've personally never had luck getting a GRE tunnel to restore itself after a failover; what I've done is simply automate the clearing and test to bring it back online via the API. As soon as I can't reach the firewall on the other end, the script triggers the clear and test commands to bring it back online.

Re: IKEv2 tunnel does not restore after HA failover

MikeSchrader — Fri, 02 Jun 2023 16:14:46 GMT

Thanks for your reply. I had a feeling this was related to GRE and I like the idea of creating an API script to use the clear and test commands to restore the tunnel. Thanks for your response.