09-02-2020 04:40 PM
We're provisioning and testing a dedicate wave circuit and an Internet-IPSEC backup between two PANs. (We are also running IPSEC over the wave circuit). We noticed a phenomena of sorts and was wondering if anyone has experienced this: We purposely failed the upstream PAN's WAVE circuit's ethernet interface to test failover to the internet-IPSEC. The wave-IPSEC tunnel went red for IKE and Tunnel Info on both head-end and remote-office. The odd thing was that we had a PAN Traffic Monitor going on the head and watching session traffic going over the wave-IPSEC; when the traffic was failed over to internet-IPSEC we still saw session traffic with new time stamps over the downed wave-IPSEC tunnel interface...We KNOW that circuit was down, unavailable and even the PAN knew it from the tunnel status. We are running OS 9.0.9.
Does anyone have any guesses, thoughts, etc?
Thanks!!
Mike
09-03-2020 03:12 PM
I feel confident a coworker has figured out what we were seeing: We have the rules set to log on session-end. We were most likely seeing the log entry (over the dead link) of the session summary as it timed-out (30 minute timer I believe we have for SSL) and therefore creating the log entry. Makes sense.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
