Symptoms

IPsec traffic selector state can be viewed in the config utility or by tmsh with the "tmsh show net ipsec traffic-selector" command. On an high availability (HA) standby device, some selector states may be incorrect.

Impact

There is no functional impact. The issue is that a selector may incorrectly appear down in one or both directions.

Conditions

-- High availability (HA) environment -- Standby reboots or in some way, such as a tmm restart, is forced to re-learn all the mirrored IPsec security associations (SAs).

Workaround

When the tunnel re-keys on the high availability (HA) active device, the selector state shows the correct value.

Fix Information

IPsec traffic selectors show the correct state after the high availability (HA) standby device reboots.

Behavior Change