Capwap Active Sessions in 2 ISP topology

[afalfaro]

Kind regards

Team

We currently have a topology in which the remote site has 2 VPNS configured (each VPN established by a different channel). The VPNs are configured against our Perimeter FW and the switching between them is done with Path Monitoring. The remote site has some Access Points that established a session (Capwap) against a controller that is located behind our Perimeter FW. The situation we present is the following.

1. When the APs connect to the controller, a Capwap session is established through tunnel 1. (Everything is fine up to there)
2. When tunnel 1 goes down, the new traffic begins to be routed through tunnel 2, however, we have seen that the Capwap sessions are being activated on tunnel 1 causing the APs to lose connectivity with the controller and the remote site's wifi is affected.
3. The way to solve this has been manually clearing all the Capwap sessions that were active so that when it tries to establish the capwap with the controller again it does so through the tunnel active at the time.

According to the evidence, we see that there are active Capwap sessions that will last up to 2 days or even more.

The question is, is there any way to modify the Capwap application timers so that the FW identifies or closes those active sessions?

Or what possible solutions could be evaluated?

[TomYoung]

Hi @afalfaro ,

There is a way to override application timeouts with custom services.  https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/app-id/service-based-session-timeouts

Here is another doc that describes your problem very well and provides a unique solution of sending an API call to itself!  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBmqCAG  I would clear all sessions filtered by destination-port, e.g. your tunnel interface, instead of UDP, but it is a great doc nonetheless.

Please let us know if any of these solutions work for you!

Thanks,

Tom