Version 3.7.8 LTSB bug fixes
High Availability - IPSec VPN
Support reference 74860
As the SAD's (Security Association Database) anti-replay counters are sent to the passive firewall, sequence numbers are incremented in line with the high availability (HA) mechanism's operating mode.
Whenever the passive firewall detected IPSec traffic in HA configurations (e.g. monitoring frames from virtual IPSec interfaces), it would also send incremented sequence numbers to the active firewall.
As a result of these successive increments, sequence numbers would quickly reach the maximum values allowed. This would then wrongly activate IPSec anti-replay protection and block traffic going through tunnels. This issue has been fixed.