IPSEC VPN Tunnel Failover and Nexus 7K VPC Design

[DamianCleveland]

Hello,

A and B question:

A. We have two Palos in A/S. The active has a functioning IPSEC VPN tunnel  terminated to it. Is there any way to have the tunnel renegotiate to the S when it becomes A?

B. What is the proper way to design an A/S PA/Nexus 7k VPC environment, to best utilize the advantages of VPC technology?

Thank you

[OtakarKlier]

Hello,

I have a very similar setup except for 9K's. For question A the answer is, its automatic. The tunnel repoints to the active pan since it takes over everything. As for B, it might depend on you config. However what I have is trunks from the Nexus to the PAN and in some cases the vlan IP resides on the PAN and some on the Nexus (we are slowly migrating everything to the PAN).

Hope that helps clear a few things up.

Cheers!

[OtakarKlier]

Here is a basic stick drawing:

[DamianCleveland]

Thanks for responding.

It's good to hear that this works. When I tried, it didn't. I obviously did something wrong. Do have any documentation on this, by chance?

I also appreciate the Nexus info. I'll double back, based on your recommedation, and try to get that connection going!

[OtakarKlier]

One thing I would like to point out is that I have only 1 link from each PAN to its corresponding Nexus so its not a criss-cross pattern. I'n not usre how you have yours wired up, but think that even in a X pattern it should work.

What didnt seem to work during a failover? 

[DamianCleveland]

Otakar,

Thanks for the imput.

My physical topology is the same as yours - no criss-cross pattern. One key difference is that we are using L3 point-to-point links instead of trunks and SVIs. Again, I'll have another look at things from the design perspective.

When we failed-over the secondary device the tunnel did not, even though the standby-device reported that it was active. Granted, it was early in the implementation stage, then it was necessary to move on to other line items. Now it's time to revisit this, so I was curious if this actually worked. Since you say that it does, I'll take a more meticulous look at the design guides for the proper configuration to complete the task.

Thank you!