Hi,
We have an Active/ Active firewall between 2 datacenters. We have configured a single tunnel on a floating IP that is Active in Datacenter A to a remote Partner. Firewall in DC A is currently in Active Secondary State, Firewall in DC B is currently in Active Primary state.
The tunnel has both phases up on the firewall in DC A and only the phase 2 on firewall in DC B (expected behaviour).
There is no VR sync configured between firewall in DC A and DC B option is not configured.
Both firewalls have static routes configured to the destination over tunnel.6.
The green line is the working scenario, user logon to citrix farm in DC A(172.25.0.0/24), the application is reachable over the tunnel 6
The red line is the non working scenario, user logon to citrix farm in DC B (172.25.3.0/4), the application doesn't work because I believe it it tryin to send it over the tunnel on firewall DC B that is not fully established. (only phase 2).
The orange line is what I would like it to do based on session ownership, sessions setup for the tunnel.
My question is is the behaviour i am seeing expected behaviour or should it work like the orange line?
... View more