After importing configs from an HA pair running 10.1.3 (for the features), and after merging the device groups and templates, we push the newly merged templates back out to the passive member. So far, so good. Then suspend to flip the active and passive members. Again, we’re doing okay. But then we push the newly merged templates out to the new passive…. When the commit gets to 99%, we lose all connectivity through the IPSec tunnels—even on the ACTIVE PA. How can a push to a passive member mess up the PSK on the ACTIVE device? (That appears to be the problem, by the way. Repairing the PSK in the crypto definition brings the tunnels back.). Config Sync is turned off. Can anyone recommend a document describing at a DEEP level what is going on when Panorama pushes and COMMITS?
... View more