High Availability Overview¶
High Availability (HA) allows established IPsec tunnels to failover without needing to re-negotiate when an Active/Standby transition happens. The new Active device already has a copy of the security associations and is aware of the message states, so is able to maintain the connection.
HA has several requirements to work correctly:
Only IKEv2 tunnels support HA failover.
IKEv1 tunnels can happily exist alongside IKEv2 tunnels, however mirroring and HA failover is only supported for IKEv2 tunnels.
HA failover works in both Interface and Tunnel mode.
Mirroring must be configured on the HA peers.
There is no additional mirroring-specific IPsec configuration required.
All IKEv2 tunnels must terminate on a floating self IP.
Check that the remote peer supports RFC6311 to guarantee tunnel continuity after failover. Some vendors, such as AWS appear not to support the RFC and so after failover the tunnel could go down if the IKE Message ID is desynchronized between the BIG-IP HA peers at the moment of failover. RFC6311 recognises and solves the situation.
Review the HA Configuration page to see information about verifying those requirements.
Review the View High Availability State page to see information about verifying whether HA is working.