Active / Active HA IPsec tunnel setup.

[zGomez]

Hi,

We have an Active/ Active firewall between 2 datacenters.  We have configured a single tunnel on a floating IP that is Active in Datacenter A to a remote Partner.  Firewall in DC A is currently in Active Secondary State,  Firewall in DC B is currently in Active Primary state.

The tunnel has both phases up on the firewall in DC A and only the phase 2 on firewall in DC B (expected behaviour).

There is no VR sync configured between firewall in DC A and DC B option is not configured.

Both firewalls have static routes configured to the destination over tunnel.6.

The green line is the working scenario, user logon to citrix farm in DC A(172.25.0.0/24), the application is reachable over the tunnel 6 

The red line is the non working scenario, user logon to citrix farm in DC B (172.25.3.0/4), the application doesn't work because I believe it it tryin to send it over the tunnel on firewall DC B that is not fully established. (only phase 2).

The orange line is what I would like it to do based on session ownership, sessions setup for the tunnel.

My question is is the behaviour i am seeing expected behaviour or should it work like the orange line?

[reaper · Accepted solution]

That's expected behavior

the orange line would only come into play on 'returning' packets where a session's packets are returned to a session owner rather than a routing option. For the A/A to allow full routing you'd need a (functional) tunnel on each member so packets can be sent out organically and then have A/A packet ownership use HA3 to 'fix' sessions on the session owner firewall for packet inspection

i.e. have 2 fully functional tunnels, syn goes out of B, ACK comes back through A, HA3 is used to pass ACK packet to B for session creation/inspection