HA deployment with IPsec tunnel

[bryanpascal]

Hello Guys ,

I have two PaloAltos' deployed in HA ( active - passive mode ) and have an IPSec tunnel configured. I have noticed that when the primary PAN ( active ) fail-over to the Secondary PAN, the IPsec tunnel does come up and need to manually start the IPsec ( via CLI ). Do you have a way when Secondary PAN become active the IPsec Tunnel come up without human intervention ?

Regards,

Bryan

[HULK]

Hello Bryan,

What do you mean by " the IPsec tunnel does come up and need to manually start the IPsec ( via CLI )".

--- Is the Phase-1 is coming UP but the phase-2 is not..?

or

---- Both Phase-1 and 2 is coming UP but traffic is not flowing through it.

Could you please share the CLI command you are applying here.

Thanks

[knarra1]

In HA configuration , phase2 ipsec is synched between the Ha pairs and you should see automatic failover to secondary device when it becomes active with out need for rekeying . But phase 1 is not synched as it is not necessary . In GUI you should see the main status (which is for phase 2 ipsec)  for tunnel green and the IKE status Red which is expected behavior. The purpose of phase1 (IKE) is to setup a secure channel for subsequent phase 2  (IPSEC) security associations (SA).  Once the phase 2 security associations have been setup, traffic travels on phase 2 SA.  Hence phase 1 can be down but traffic across the tunnel still works (because phase 2 is up).