IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

Reply
L1 Bithead

IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

Hello,

 

A and B question:

 

A. We have two Palos in A/S. The active has a functioning IPSEC VPN tunnel  terminated to it. Is there any way to have the tunnel renegotiate to the S when it becomes A?

 

B. What is the proper way to design an A/S PA/Nexus 7k VPC environment, to best utilize the advantages of VPC technology?

 

Thank you

L7 Applicator

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

Hello,

I have a very similar setup except for 9K's. For question A the answer is, its automatic. The tunnel repoints to the active pan since it takes over everything. As for B, it might depend on you config. However what I have is trunks from the Nexus to the PAN and in some cases the vlan IP resides on the PAN and some on the Nexus (we are slowly migrating everything to the PAN).

 

Hope that helps clear a few things up.

 

Cheers!

L7 Applicator

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

Here is a basic stick drawing:

 

image.png

L1 Bithead

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

Thanks for responding.

 

It's good to hear that this works. When I tried, it didn't. I obviously did something wrong. Do have any documentation on this, by chance?

 

I also appreciate the Nexus info. I'll double back, based on your recommedation, and try to get that connection going!

L7 Applicator

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

One thing I would like to point out is that I have only 1 link from each PAN to its corresponding Nexus so its not a criss-cross pattern. I'n not usre how you have yours wired up, but think that even in a X pattern it should work.

 

What didnt seem to work during a failover? 

Highlighted
L1 Bithead

Re: IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

Otakar,

 

Thanks for the imput.

 

My physical topology is the same as yours - no criss-cross pattern. One key difference is that we are using L3 point-to-point links instead of trunks and SVIs. Again, I'll have another look at things from the design perspective.

 

When we failed-over the secondary device the tunnel did not, even though the standby-device reported that it was active. Granted, it was early in the implementation stage, then it was necessary to move on to other line items. Now it's time to revisit this, so I was curious if this actually worked. Since you say that it does, I'll take a more meticulous look at the design guides for the proper configuration to complete the task.

 

Thank you!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!