ACE ipsec issue

Question

Hello,
we are using the ACE to establish a redundancy for our vpn devices.
In this setup there is one aktiv and one standby box.
If the primary box goes down all the tunnels are put to the standby box, this is working as expected.
Now we have the Problem that If the primary box comes back online the tunnel is not correctly balanced back to the primary box.
On the backup box the tunnel is still in qm idle and on the no back in service primäry box the tunnel is stucked in the state ag_init_exch.
To get the tunnel back to the primary box the connection table on the ace need to get cleared. (clear conn all)
Thus we do have an active/standby construct stickiness is not required. (and its not working either i tried it)
Here the snipets of the config
serverfarm host backup_1
transparent
failaction purge
probe ICMP
rserver ONE
     backup-rserver TWO
     inservice
rserver TWO
     inservice standby
class-map match-any IPSEC
     match virtual-address 1.1.1.1 50    
     match virtual-address 1.1.1.1 udp eq 500
     match virtual-address 1.1.1.1 udp eq 4500
policy-map type loadbalance first-match IPSEC
         class class-default
          serverfarm serverfarm host backup_1
Same setup but with two serverfarms
serverfarm host backup_1
transparent
failaction purge
probe ICMP
rserver ONE
       inservice
serverfarm host backup_2
transparent
failaction purge
probe ICMP
rserver TWO
       inservice
class-map match-any IPSEC
     match virtual-address 1.1.1.1 50    
     match virtual-address 1.1.1.1 udp eq 500
     match virtual-address 1.1.1.1 udp eq 4500
policy-map type loadbalance first-match IPSEC
         class class-default
           serverfarm host backup_1 backup backup_2
Thanks for any help in advanced

Answer 1

Hi again,
@Joo you are right if a scenario is used with an primary and a backup rserver, but if you use a primary and backup serverfarm it should work in theory, but it does not work in practice.
Enabling Load Balancing to a Server Farm (Configuring a Backup Server Farm)
You can load balance a client request for content to a server farm by using the serverfarm command in policy-map class configuration mode. Server farms are groups of networked real servers that contain the same content and that typically reside in the same physical location. The syntax of this command is as follows:
serverfarm name1 [backup name2 [sticky] [aggregate-state]]
The keywords, arguments, and options are as follows:
•name1—Unique identifier of the server farm. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
•backup name2—(Optional) Designates an existing server farm as a backup server farm in case all the servers in the original server farm become unavailable. When at least one server in the primary server farm becomes available again, the ACE sends all connections to the primary server farm. Enter the name of an existing server farm that you want to specify as a backup server farm as an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
regards
ed