Push to an HA passive PA causes active PA IPSec tunnel to drop, sync is off

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Push to an HA passive PA causes active PA IPSec tunnel to drop, sync is off

L0 Member

After importing configs from an HA pair running 10.1.3 (for the features), and after merging the device groups and templates, we push the newly merged templates back out to the passive member.  So far, so good.  Then suspend to flip the active and passive members.  Again, we’re doing okay.  But then we push the newly merged templates out to the new passive…. When the commit gets to 99%, we lose all connectivity through the IPSec tunnels—even on the ACTIVE PA.   
     How can a push to a passive member mess up the PSK on the ACTIVE device?  (That appears to be the problem, by the way.  Repairing the PSK in the crypto definition brings the tunnels back.). Config Sync is turned off.  
     Can anyone recommend a document describing at a DEEP level what is going on when Panorama pushes and COMMITS?  

  • 0 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!