I restored the HA pair back to Active/Standby.
1 remaining issue.
I have 3 IPsec Site-to_SIte tunnels.
I noticed that when the NEW UNIT becomes ACTIVE that I am unble to pass traffic over the VPN tunnels.
When I failback I am able to pass traffic.
Are those VPN tunnels perchance certificate-based? If so, you need to copy the certificates onto the replaced unit.
(Disk operations such as copying certificate files are not included in a configuration synchronization process.)
Can you say exactly what is happening on the new active box?
show crypto isakmp sa/show crypto ipsec sa
to see what exaclty is happening with the tunnels. It seems like a IPSEC replication issue.
Are versions on both boxes the same?
As I understand this output is from primary standby-ready or when it is active?
When you are intiating traffic are the counters in show crypto ipsec sa increasing?
The best would be to do some online debugging for it. If possible I would suggest to create TAC case for that.