IPSec HA Failover

[spapesh]

As of this post, Palo Alto Firewalls do not sync Phase 1 for IPSec Tunnels. If a remote end is using Dead Peer Detection, this will cause the tunnel to go down after a failover occurs and the remote end DPD hits its threshold. Since the Palo no longer has Phase 1, it cannot respond to the DPD. Despite Phase 2 being up and working, the DPD will pull down the tunnel. The Palo thinks the tunnel remains. Traffic will stop.

Recommended work arounds are to disable the DPD on the remote side or enable tunnel monitoring.

Certain cloud providers are not providing an option to disable DPD. Therefore, a tunnel monitor is the other option provided by Palo. While tunnel monitor technically works, I have asked Palo to look at syncing Phase 1.

A feature request requesting the syncing of Phase 1 exists. 

Palo Support provided me with the following:

Feature Request NSFR-I-26043

Please have your account team vote on it on your behalf if this is a feature you want.

[nohash4u]

@spapesh great thoughts. 

For those curious there is a great KB article here: What is Dead Peer Detection and Tunnel Monitoring across IPSec ... - Knowledge Base - Palo Alto Netw...

I am curious if there are pieces of the IKEv2 phase 1 exchange that are unique to the active NGFW, and thus unable to be synced over. Without going down the rabbit hole too much there is lots of information in the IKEv2 RFC: https://www.rfc-editor.org/rfc/pdfrfc/rfc7296.txt.pdf 

Even at a high level, the section around page 10 on the initial exchange indicates multiple parameters that are exchanged for the purpose of authentication with are specific to the initiator and the responder. Perhaps this sheds insight into why phase 1 cannot be synced? 

Also curious to know how other vendors handle this problem. 

Cheers