USG6300 standby firewall cannot build IPSEC VPN in active standby mode.

Created: Aug 24, 2018 06:03:14Latest reply: Dec 1, 2021 01:40:20 869 3 1 0 0

Issue Description

Device version:V500R001C60SPC500

Alarm Information

Debug ikev2 all and IPSEC all we can see below error:

Aug 20 2018 12:19:54.790.4+05:00 MDC-CFW-02 IKE/7/IKE_Debug:Slot=4/3,Vcpu=0;

IKE_INFO 5:1497 IKE handle message: message peer address is 10.13.97.60, vpnid is 0

Aug 20 2018 12:19:54.790.5+05:00 MDC-CFW-02 IKE/7/IKE_Debug:Slot=4/3,Vcpu=0;

IKE_ERROR 5:1529 IKE handle message: dropped since the interface 0x1f state is slave

Aug 20 2018 12:19:54.940.4+05:00 MDC-CFW-02 IKE/7/IKE_Debug:Slot=5/0,Vcpu=0;

IKE_INFO 5:1497 IKE handle message: message peer address is 10.13.99.124, vpnid is 0

Aug 20 2018 12:19:54.940.5+05:00 MDC-CFW-02 IKE/7/IKE_Debug:Slot=5/0,Vcpu=0;

IKE_ERROR 5:1529 IKE handle message: dropped since the interface 0x1f state is slave

Handling Process

Do capture on peer device finding standby firewall did not reply the IPSEC packets.

everything is working fine on active firewall.

Root Cause

IPSEC is established between the peer and the active firewall.

Active firewall will sync the session to standby firewall.

However, in general, the standby is in the backup state, that is, it is not working, so IPSEC cannot be established with the standby directly.

Solution

If you need build 2 IPSEC VPN tunnels with active and standby firewall, you have to add alone after the IPSEC POLICY under interface.

after you add this command, both firewalls will be treated as alone. standby will not sync the session from active, you can build 2 IPSEC VPN tunnels.

for the command details, please refer below:

http://support.huawei.com/hedex/pages/EDOC1000154459AEH0731H/06/EDOC1000154459AEH0731H/06/resources/dc/ipsec_policy_interface_view.html?ft=0&fe=10&hib=11.1.12.2.97&id=ipsec_policy_interface_view&text=ipsec%20policy%20(interface%20view)&docid=EDOC1000154459