Azure HA

Hello Tobias Steiger , 

Thank you for reaching out to the community, did you refer this - Configure HA in Azure using a template and Implement a full HA (inbound/outbound) on Azure.

Hello Vivek

Thank you for your respond! 

Yes, I read through these guides and I currently use Auzure Availability Sets to achieve HA for my instances - but the problem I face is config sync and IPsec tunnels.

Firstly, config sync would be nice (like active-passive) so my clients would not always need to export / import firewall configs if they change something. Also, im currently using 2 XGs behind an Azure Loadbalancer. Whenver I only use 1 firewall (and stop the other) IPsec works really fine even behind the LB. However, if both firewalls are live, IPsec stops working and my site-to-site VPNs go down.

So, achieving active-passive would be really nice but i guess this is not possible in Azure (as stated in https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/122520/sophos-firewall-implement-a-full-ha-inbound-outbound-on-azure)

Azure uses SD-Network technologies to connect devices. The rules "of the old world" like ARP and other stuff does not apply there anymore. If you change for example the default gateway to another device, the device is fully offline. Therefore, you will not get the link between both appliances, and you will not get the ARP change to virtual running. 

You could disable ARP Spoofing on SFOS in the WebUI, which uses the physical MACs, but even then, you have a "vIP", which will be used. Azure does not allow a IP Move from A to B.