topic Re: VPN Failure after ClusterXL Failover in Firewall and Security Management

VPN Failure after ClusterXL Failover

Martin_S_1 — Fri, 18 Feb 2022 10:15:08 GMT

Hi,

I was deleting an interface yesterday on our ClusterXL pair of 7000's. The process caused a failover between the two units after I changed the interface from 'Cluster' to 'Private' in SmartConsole. After this the two units failed over. Our site-to-site VPNs we have that terminate on this ClusterXL pair then stopped working. The VPN is a VTI type from what I understand. From the remote side, our third party told us they could see the VPN's were down, but from our side they appeared to be up, SmartView Monitor showed them as up, and we could see Phase1 and Phase 2 SA's using vpn tu. However, what we then noticed was that the BGP peers relationships which run through these VPN tunnels had stopped working. Nothing we did would bring them back up. It was only once we failed the units back over to the original gateway that was active before starting, the BGP peer relationships came back up and VPN's came back up.

We didn't know why the BGP peer relationships and VPNs failed when we failed over to the other cluster member. Has anyone seen this before or how to troubleshoot this?

Re: VPN Failure after ClusterXL Failover

Juan_ — Fri, 18 Feb 2022 10:17:07 GMT

Is your router-id a VIP?

Re: VPN Failure after ClusterXL Failover

Chris_Atkinson — Fri, 18 Feb 2022 10:27:41 GMT

What's the router-id configured as and do you use graceful restart?

Re: VPN Failure after ClusterXL Failover

Martin_S_1 — Fri, 18 Feb 2022 10:30:24 GMT

Yes, the BGP router-id is a VIP.

Re: VPN Failure after ClusterXL Failover

Martin_S_1 — Fri, 18 Feb 2022 10:42:23 GMT

Hi Chris, how do you normally check if we use graceful restart? Our router-id is configured as one of the cluster IP address VIPs.

Re: VPN Failure after ClusterXL Failover

Martin_S_1 — Fri, 18 Feb 2022 11:10:34 GMT

Graceful restart is not enabled.

Re: VPN Failure after ClusterXL Failover

Chris_Atkinson — Fri, 18 Feb 2022 11:42:26 GMT

What is the remote end?

Generally it is recommend to enable graceful restart for clustered configurations.