topic session disconnect during A-P failover in General Topics

session disconnect during A-P failover

Jimmy20 — Wed, 30 Sep 2020 14:34:29 GMT

Hi,

Can anyone suggest, if we failover from Active to Passive unit on PA firewall. will this maintains the established sessions by default.

Or we have to additionally enable some other setting to make this enable (should maintain session during cluster failover).

Additionally, one more observation while we did recent failover....We have 09 IPSec tunnels created on PA (phase-1 and phase-2 both active) .

- When we did failover from active to passive (and passive unit became the new active).

- We observed that approx 5-6 IPSec tunnels (phase-1 and phase-2 both) were active on new active unit.

- However rest 3-4 IPSec tunnels are showing Phase-2 down (but phase-1 active) on new Active but showing active (both phase-1 and phase-2) on new passive units.

Rgds

Re: session disconnect during A-P failover

OtakarKlier — Wed, 30 Sep 2020 21:48:37 GMT

Hello,

Check out these resources on HA.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIbCAK

However the sessions should go over to the new Active unit. I have seen in the past where the VPN tunnels didnt like the failover, these were mostly to other products other than PAN. However PAN to PAN, they seem to be OK. See if passing traffic over the tunnels helps them establish, say a continuous ping.

But check the logs to see why the tunnels are not coming up from the far side, i.e. the firewall receiving the tunnel connection.

Regards,

Re: session disconnect during A-P failover

BPry — Wed, 30 Sep 2020 22:12:31 GMT

@Jimmy20,

In my experience @OtakarKlier is absolutely correct. I would normally expect a PAN to PAN tunnel to stay online during a failover, but once you start crossing vendors things can be a bit hit or miss. A lot of this has to do with DPD and other similar settings not playing correctly if they are setup on one side or another.

I'll still occasionally have issues with PAN to PAN tunnels, but DPD and tunnel monitoring will easily correct any issues that would be caused by this and bring the tunnels back online.