Passive PA and IPSEC Connections

[MP18]

We have PA in active passive mode,

We have ipsec connections going to end devices.

When i check the passive PA GUI  I see 

All Phase 1 connections as red

All Phase 2 connections as green

IS this normal behaviour?

[Remo · Accepted solution]

Hi @MP18 

Yes, this is normal because only the phase 2 SAs are synced in an active-passive cluster.

[Remo · Accepted solution]

More details about what runtime information is synced in a HA pair you can find here: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/reference-ha-synchroniza...

[MP18]

Thanks for useful link