topic Re: VPN Phase 1 Not Synchronized between HA pair in General Topics

VPN Phase 1 Not Synchronized between HA pair

seag — Thu, 18 Jan 2024 19:42:29 GMT

Hello guys,

Sorry if this topic has been already discussed before but I could not find an answer.

I would like to know why phase 1 is not synchronized between HA pair. Is there a particular reason ?

Thanks

Re: VPN Phase 1 Not Synchronized between HA pair

JayGolf — Fri, 19 Jan 2024 22:36:20 GMT

Hi @seag ,

That's an interesting question! I would think the reason why is that the passive firewall is not involved in the IKE negotiation process. Since the primary firewall proposes and establishes phase 1 with the peer, the passive firewall has no phase 1 SA.

Re: VPN Phase 1 Not Synchronized between HA pair

BPry — Fri, 19 Jan 2024 23:19:19 GMT

@seag,

Primary reason as far as I'm aware is the same issue that you'll see even on vendors that allow SAs to sync, the sequence number wouldn't stay in sync anyways. So Fortinet as an example you can continue to receive traffic after a failover without a re-key, but as soon as outbound traffic is sent a re-key is required.

PAN and some other vendors have taken the stance that simply configuring it to utilize tunnel monitoring and renegotiating is a better path forward that has consistent behavior.

Re: VPN Phase 1 Not Synchronized between HA pair

seag — Tue, 23 Jan 2024 09:09:32 GMT

@BPry

Thanks for this explanation... I understand. Imagine the following scenario :

You have an HA Pair with a hundred VPN IPSec tunnels on it. The HA pair is configured in passive mode Gateway.

After a failover, is there a way to prevent the loss of those tunnels without involving peers ?