topic Re: IPSEC Tunnels and HA Failover in General Topics

IPSEC Tunnels and HA Failover

MarkTan — Thu, 30 Jan 2014 14:13:38 GMT

Hello,

In a scenario with two palo alto firewalls where the active firewall fails over to the passive firewall, if there are IPSEC tunnels established are they suppose to automatically come up on the second firewall when the failover occurs or do we have to initialize them manually? If we wanted them to automatically come up, how would we do so? Can someone provide a configuration example?

Thanks,

Mark

Re: IPSEC Tunnels and HA Failover

HULK — Thu, 30 Jan 2014 15:55:56 GMT

Hello Sir,

After HA failover, do you have an interesting traffic attempting to pass through this VPN tunnel...? PAN firewall will bring the tunnel upon traffic. If there is no traffic attempting to pass through

VPN tunnel, you can manually initiate the tunnel to come up.

>test vpn ike-sa xxx

> test vpm ipsec-sa xxx

Thanks

Re: IPSEC Tunnels and HA Failover

darren_g — Wed, 05 Feb 2014 00:02:02 GMT

MarkTan wrote:

Hello,

Thanks,

Mark

In my experience, as long as the tunnel is actually active (I.E. currently passing traffic), then yes, they do. And without interruption to traffic flows, normally.

I have occasionally run into issues when failing *back* from the HA peer to the normal "primary" - sometimes that will drop and re-establish the tunnel almost immediately - but that's enough to break some things (I have a GRE tunnel which goes through the Palo Alto and terminates on another device inside my network - when this drop out occurs, the GRE tunnel always breaks).

Cheers.

Re: IPSEC Tunnels and HA Failover

HULK — Wed, 05 Feb 2014 01:45:43 GMT

Hello,

You are correct, if the current traffic passing through the tunnel, it will come up automatically.

Thanks