topic Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design in General Topics

IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

DamianCleveland — Wed, 03 Jan 2018 19:49:34 GMT

Hello,

A and B question:

A. We have two Palos in A/S. The active has a functioning IPSEC VPN tunnel terminated to it. Is there any way to have the tunnel renegotiate to the S when it becomes A?

B. What is the proper way to design an A/S PA/Nexus 7k VPC environment, to best utilize the advantages of VPC technology?

Thank you

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

OtakarKlier — Wed, 03 Jan 2018 20:09:27 GMT

Hello,

I have a very similar setup except for 9K's. For question A the answer is, its automatic. The tunnel repoints to the active pan since it takes over everything. As for B, it might depend on you config. However what I have is trunks from the Nexus to the PAN and in some cases the vlan IP resides on the PAN and some on the Nexus (we are slowly migrating everything to the PAN).

Hope that helps clear a few things up.

Cheers!

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

OtakarKlier — Wed, 03 Jan 2018 20:15:22 GMT

Here is a basic stick drawing:

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

DamianCleveland — Thu, 04 Jan 2018 12:51:01 GMT

Thanks for responding.

It's good to hear that this works. When I tried, it didn't. I obviously did something wrong. Do have any documentation on this, by chance?

I also appreciate the Nexus info. I'll double back, based on your recommedation, and try to get that connection going!

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

OtakarKlier — Thu, 04 Jan 2018 14:57:59 GMT

One thing I would like to point out is that I have only 1 link from each PAN to its corresponding Nexus so its not a criss-cross pattern. I'n not usre how you have yours wired up, but think that even in a X pattern it should work.

What didnt seem to work during a failover?

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

DamianCleveland — Fri, 05 Jan 2018 14:53:47 GMT

Otakar,

Thanks for the imput.

My physical topology is the same as yours - no criss-cross pattern. One key difference is that we are using L3 point-to-point links instead of trunks and SVIs. Again, I'll have another look at things from the design perspective.

When we failed-over the secondary device the tunnel did not, even though the standby-device reported that it was active. Granted, it was early in the implementation stage, then it was necessary to move on to other line items. Now it's time to revisit this, so I was curious if this actually worked. Since you say that it does, I'll take a more meticulous look at the design guides for the proper configuration to complete the task.

Thank you!