Monitor Traffic Shows Sess Still Active over Tunnel Even After Int Failed

michaelmertens — Wed, 02 Sep 2020 23:40:13 GMT

We're provisioning and testing a dedicate wave circuit and an Internet-IPSEC backup between two PANs. (We are also running IPSEC over the wave circuit). We noticed a phenomena of sorts and was wondering if anyone has experienced this: We purposely failed the upstream PAN's WAVE circuit's ethernet interface to test failover to the internet-IPSEC. The wave-IPSEC tunnel went red for IKE and Tunnel Info on both head-end and remote-office. The odd thing was that we had a PAN Traffic Monitor going on the head and watching session traffic going over the wave-IPSEC; when the traffic was failed over to internet-IPSEC we still saw session traffic with new time stamps over the downed wave-IPSEC tunnel interface...We KNOW that circuit was down, unavailable and even the PAN knew it from the tunnel status. We are running OS 9.0.9.

Does anyone have any guesses, thoughts, etc?

Thanks!!

Mike

Re: Monitor Traffic Shows Sess Still Active over Tunnel Even After Int Fail

michaelmertens — Thu, 03 Sep 2020 22:12:53 GMT

I feel confident a coworker has figured out what we were seeing: We have the rules set to log on session-end. We were most likely seeing the log entry (over the dead link) of the session summary as it timed-out (30 minute timer I believe we have for SSL) and therefore creating the log entry. Makes sense.

topic Re: Monitor Traffic Shows Sess Still Active over Tunnel Even After Int Fail in General Topics

Monitor Traffic Shows Sess Still Active over Tunnel Even After Int Failed

Re: Monitor Traffic Shows Sess Still Active over Tunnel Even After Int Fail