Azure VPN Failover does not return after primary connection comes online

Question

Hi, 
 We have scenario where: 
 
 Sophos UTM is connected with Sophos XG in Azure 
 Sophos UTM have two internet connections in Active/standby mode 
 Sophos XG Site-to-Site is configured with Failover Group 
 
 First step is Ok. 
 
 When Primary link on UTM goes down, standby becomes active and on XG failover group switch to second VPN. 
 
 Second step does not work. 
 
 When Primary link becomes available site-to-site stops working. For some unknown reason it does not failover back to primary? Anyone have same issues? 
 
 Azure Firmware: SFOS 16.05.0 GA

sachingurung · Accepted Answer

Hi Idriel, 
 Contrary to my question, once a failover happens the connection cannot come back on the primary WAN connection automatically after it comes online. You need to do it manually. 
 Thanks

Aditya Patel · Answer

HI Idriel, 
 It is by Design, Once the IPsec Tunnel is established it will continue to follow the connection and will not disconnect unless disconnected manually to ensure uninterrupted service. If you wish to use the Primary link , then you may need to disable the failover and enable again to reset the connection status .