Configuration Help

Greetings!

To address the issue of outbound WAN IP changes during failover in an Active-Passive HA firewall system and the need to establish a VPN to the same destination, follow these steps:

1. Prevent the phase1-interface configuration sync between the HA members:
- Configure VDOM exceptions to prevent the sync:
```
config system vdom-exception
edit 0
set object vpn.ipsec.phase1-interface
next
end
```

2. Change the local-gw on the passive firewall according to its WAN interface IPs:
- Update the local-gw for each phase1-interface configuration:
```
config vpn ipsec phase1-interface
edit VPN-1
set local-gw <primary private IP>
next
edit VPN-2
set local-gw <secondary private IP 1>
next
edit VPN-3
set local-gw <secondary private IP 2>
next
end
```

By following these steps, you can ensure that both HA members can bring up the IPsec tunnel even after a failover with outbound WAN IP changes. Remember to trigger the failover and test the IPsec tunnels after making these configurations.

Regards!