IPSEC VPN tunnel goes down after HA-failover

• Firewalls configured in Active/Passive HA Pair.
• Supported PAN-OS
• High-Availability
• DPD Enabled

• IKE SA's are not synched but IPSec SA's are synced after failover, but the remote peer is sending DPD packets with the IKE SA that the newly active member does not have, so it cannot reply to those DPD messages
• The newly active member loses main mode information after failover and it has to renegotiate the phase-1 again
• The remote peer is sending DPD packets containing Palo Alto peer IKE SA but the newly active member does not have IKE SA anymore to read the messages.
• DPD uses ike main mode SA's and the main mode is not synced to another peer
• Phase 1 SAs are not synchronized between the HA peers, only Phase 2 SAs are synchronized. Therefore, it is expected that DPD fails after a failover.

Workaround: Configure the tunnel monitoring as it will renegotiate the phase-1 or Disable the DPD