VPN Phase 1 Not Synchronized between HA pair

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

VPN Phase 1 Not Synchronized between HA pair

L0 Member

Hello guys,

 

Sorry if this topic has been already discussed before but I could not find an answer.

 

I would like to know why phase 1 is not synchronized between HA pair. Is there a particular reason ?

 

Thanks

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@seag,

Primary reason as far as I'm aware is the same issue that you'll see even on vendors that allow SAs to sync, the sequence number wouldn't stay in sync anyways. So Fortinet as an example you can continue to receive traffic after a failover without a re-key, but as soon as outbound traffic is sent a re-key is required.

PAN and some other vendors have taken the stance that simply configuring it to utilize tunnel monitoring and renegotiating is a better path forward that has consistent behavior. 

View solution in original post

3 REPLIES 3

Community Team Member

Hi @seag ,

 

That's an interesting question! I would think the reason why is that the passive firewall is not involved in the IKE negotiation process.  Since the primary firewall proposes and establishes phase 1 with the peer, the passive firewall has no phase 1 SA. 

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Cyber Elite
Cyber Elite

@seag,

Primary reason as far as I'm aware is the same issue that you'll see even on vendors that allow SAs to sync, the sequence number wouldn't stay in sync anyways. So Fortinet as an example you can continue to receive traffic after a failover without a re-key, but as soon as outbound traffic is sent a re-key is required.

PAN and some other vendors have taken the stance that simply configuring it to utilize tunnel monitoring and renegotiating is a better path forward that has consistent behavior. 

@BPry 

Thanks for this explanation... I understand. Imagine the following scenario :

 

You have an HA Pair with a hundred VPN IPSec tunnels on it. The HA pair is configured in passive mode Gateway.

After a failover, is there a way to prevent the loss of those tunnels without involving peers ?

  • 1 accepted solution
  • 824 Views
  • 3 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!