VPN Phase 1 Not Synchronized between HA pair

[seag]

Hello guys,

Sorry if this topic has been already discussed before but I could not find an answer.

I would like to know why phase 1 is not synchronized between HA pair. Is there a particular reason ?

Thanks

[JayGolf]

Hi @seag ,

That's an interesting question! I would think the reason why is that the passive firewall is not involved in the IKE negotiation process.  Since the primary firewall proposes and establishes phase 1 with the peer, the passive firewall has no phase 1 SA. 

[BPry · Accepted solution]

@seag,

Primary reason as far as I'm aware is the same issue that you'll see even on vendors that allow SAs to sync, the sequence number wouldn't stay in sync anyways. So Fortinet as an example you can continue to receive traffic after a failover without a re-key, but as soon as outbound traffic is sent a re-key is required.

PAN and some other vendors have taken the stance that simply configuring it to utilize tunnel monitoring and renegotiating is a better path forward that has consistent behavior. 

[seag]

@BPry 

Thanks for this explanation... I understand. Imagine the following scenario :

You have an HA Pair with a hundred VPN IPSec tunnels on it. The HA pair is configured in passive mode Gateway.

After a failover, is there a way to prevent the loss of those tunnels without involving peers ?