session disconnect during A-P failover

[Jimmy20]

Hi,

Can anyone suggest, if we failover from Active to Passive unit on PA firewall. will this maintains the established sessions by default. 

Or we have to additionally enable some other setting to make this enable (should maintain session during cluster failover).

Additionally, one more observation while we did recent failover....We have 09 IPSec tunnels created on PA (phase-1 and phase-2 both active) .

- When we did failover from active to passive (and passive unit became the new active).

- We observed that approx 5-6 IPSec tunnels (phase-1 and phase-2 both) were active on new active unit.

- However rest 3-4 IPSec tunnels are showing Phase-2 down (but phase-1 active) on new Active but showing active (both phase-1 and phase-2) on new passive units.

Rgds 

[OtakarKlier]

Hello,

Check out these resources on HA.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIbCAK

However the sessions should go over to the new Active unit. I have seen in the past where the VPN tunnels didnt like the failover, these were mostly to other products other than PAN. However PAN to PAN, they seem to be OK. See if passing traffic over the tunnels helps them establish, say a continuous ping.

But check the logs to see why the tunnels are not coming up from the far side, i.e. the firewall receiving the tunnel connection.

Regards,

[BPry]

@Jimmy20,

In my experience @OtakarKlier is absolutely correct. I would normally expect a PAN to PAN tunnel to stay online during a failover, but once you start crossing vendors things can be a bit hit or miss. A lot of this has to do with DPD and other similar settings not playing correctly if they are setup on one side or another.

I'll still occasionally have issues with PAN to PAN tunnels, but DPD and tunnel monitoring will easily correct any issues that would be caused by this and bring the tunnels back online.