IPSEC Tunnels and HA Failover

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

IPSEC Tunnels and HA Failover

L2 Linker

Hello,

In a scenario with two palo alto firewalls where the active firewall fails over to the passive firewall, if there are IPSEC tunnels established are they suppose to automatically come up on the second firewall when the failover occurs or do we have to initialize them manually? If we wanted them to automatically come up, how would we do so? Can someone provide a configuration example?


Thanks,

Mark

3 REPLIES 3

L7 Applicator

Hello Sir,

After HA failover, do you have an interesting traffic attempting to pass through this VPN tunnel...? PAN firewall will bring the tunnel upon traffic. If there is no traffic attempting to pass through 

VPN tunnel, you can manually initiate the tunnel to come up.


>test vpn ike-sa xxx

> test vpm ipsec-sa xxx


Thanks

L4 Transporter

MarkTan wrote:

Hello,

In a scenario with two palo alto firewalls where the active firewall fails over to the passive firewall, if there are IPSEC tunnels established are they suppose to automatically come up on the second firewall when the failover occurs or do we have to initialize them manually? If we wanted them to automatically come up, how would we do so? Can someone provide a configuration example?


Thanks,

Mark

In my experience, as long as the tunnel is actually active (I.E. currently passing traffic), then yes, they do. And without interruption to traffic flows, normally.

I have occasionally run into issues when failing *back* from the HA peer to the normal "primary" - sometimes that will drop and re-establish the tunnel almost immediately - but that's enough to break some things (I have a GRE tunnel which goes through the Palo Alto and terminates on another device inside my network - when this drop out occurs, the GRE tunnel always breaks).

Cheers.

Hello,

You are correct, if the current traffic passing through the tunnel, it will come up automatically.

Thanks

  • 4356 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!