VPN Failure after ClusterXL Failover

[Martin_S_1]

Hi, 

I was deleting an interface yesterday on our ClusterXL pair of 7000's. The process caused a failover between the two units after I changed the interface from 'Cluster' to 'Private' in SmartConsole. After this the two units failed over. Our site-to-site VPNs we have that terminate on this ClusterXL pair then stopped working. The VPN is a VTI type from what I understand. From the remote side, our third party told us they could see the VPN's were down, but from our side they appeared to be up, SmartView Monitor showed them as up, and we could see Phase1 and Phase 2 SA's using vpn tu. However, what we then noticed was that the BGP peers relationships which run through these VPN tunnels had stopped working. Nothing we did would bring them back up. It was only once we failed the units back over to the original gateway that was active before starting, the BGP peer relationships came back up and VPN's came back up. 

We didn't know why the BGP peer relationships and VPNs failed when we failed over to the other cluster member. Has anyone seen this before or how to troubleshoot this?

[Juan_]

Is your router-id a VIP?

[Martin_S_1]

Yes, the BGP router-id is a VIP. 

[Chris_Atkinson]

What's the router-id configured as and do you use graceful restart?

[Martin_S_1]

Hi Chris, how do you normally check if we use graceful restart? Our router-id is configured as one of the cluster IP address VIPs.

[Martin_S_1]

Graceful restart is not enabled. 

[Chris_Atkinson]

What is the remote end?

Generally it is recommend to enable graceful restart for clustered configurations.