IPSec Site to Site Tunnel with HA

[jp_rae]

I have 2 OPNSense appliances configured and running in HA mode. CARP / HA Failover / pfSync seem to be working fine, except for one thing. We have an IPSec tunnel to a remote site that needs to be re-established when the failover occurs. In our case, the IPSec tunnel does not re-establish (yes, IPSec is selected to sync and it appears to be working).

What I would expect is that the MASTER would connect to the tunnel and upon failover, the BACKUP would connect to the tunnel. But, what I see is that both the MASTER and the BACKUP are attempting to connect at the same time.

Are there any documents or sample configurations for this? I can't seem to find any and would like some assistance with this.

[mimugmail]

In Phase1 set the option "Disable MOBIKE".
MOBIKE will try to keep the tunnel open, also when IP switches over.

[jp_rae]

I will try that and let you know what happens.

[jp_rae]

This did not work. Both nodes are coming up and trying to connect to the IPSEC tunnel. That is not what should be happening.

[mimugmail]

Screenshot of Phase1 please

[jp_rae]

Here you go.

[mimugmail]

Interface in Phase1 needs to be a carp IP

[jp_rae]

Thank you. That seems to have solved the problem. For whatever reason, the CARP address was not selectable when we created the tunnel. But, it was there when I went to edit it.

Thanks