HA Active/Active and VPN

[sajidsil]

Hello,

We have a scenario where a customer wants to deploy two PA3250s in two different locations which will be an Active/Active cluster. There will be a layer 2 link between the two sites and also customer wants a VPN as a backup if the layer 2 link goes down.

Is this possible? How can we implement this if possible?

Thanks.

[Alex_Samad]

I've done this with 5220 and HA.

create VIP and share them between HA.

So GP portal is HA'ed between the 2 nodes

node1 has gw1 with  a vip that is available on both

node2 has gw2 with a vip that is available on both

But you have to use a min of 8.0.11 as there is an issue with HA and GP and some packets not crossing HA3 - i had this issue for quiet a while

A

[sajidsil]

Thank you for your reply. In my scenario it is a site to site VPN between the two sites.

[Alex_Samad]

haven't done ipsec tunnels. but my understanding is that GP using ipsec underneath.