topic Re: HA deployment with IPsec tunnel in General Topics

HA deployment with IPsec tunnel

bryanpascal — Tue, 17 Jun 2014 07:12:02 GMT

Hello Guys ,

I have two PaloAltos' deployed in HA ( active - passive mode ) and have an IPSec tunnel configured. I have noticed that when the primary PAN ( active ) fail-over to the Secondary PAN, the IPsec tunnel does come up and need to manually start the IPsec ( via CLI ). Do you have a way when Secondary PAN become active the IPsec Tunnel come up without human intervention ?

Regards,

Bryan

Re: HA deployment with IPsec tunnel

HULK — Tue, 17 Jun 2014 15:48:54 GMT

Hello Bryan,

What do you mean by " the IPsec tunnel does come up and need to manually start the IPsec ( via CLI )".

--- Is the Phase-1 is coming UP but the phase-2 is not..?

---- Both Phase-1 and 2 is coming UP but traffic is not flowing through it.

Could you please share the CLI command you are applying here.

Thanks

Re: HA deployment with IPsec tunnel

knarra1 — Tue, 17 Jun 2014 18:04:01 GMT

In HA configuration , phase2 ipsec is synched between the Ha pairs and you should see automatic failover to secondary device when it becomes active with out need for rekeying . But phase 1 is not synched as it is not necessary . In GUI you should see the main status (which is for phase 2 ipsec) for tunnel green and the IKE status Red which is expected behavior. The purpose of phase1 (IKE) is to setup a secure channel for subsequent phase 2 (IPSEC) security associations (SA). Once the phase 2 security associations have been setup, traffic travels on phase 2 SA. Hence phase 1 can be down but traffic across the tunnel still works (because phase 2 is up).