https://live.paloaltonetworks.com/t5/next-generation-firewall/path-monitoring-vs-bgp/m-p/581466#M2875 <P>Hey community,</P> <P>We have a dual ISP environment, when one is used as a backup if the primary line stops working.</P> <P>I'm wondering what would be the best approach to configure HA in this situation (on the VR). I did it with path monitoring as it seems much simpler and straight forward. But can't decide if BGP is the better option for this scenario.</P> <P>&nbsp;</P> <P>Thanks!</P> Sun, 24 Mar 2024 09:41:26 GMT Marisableb 2024-03-24T09:41:26Z https://live.paloaltonetworks.com/t5/next-generation-firewall/path-monitoring-vs-bgp/m-p/581466#M2875 <P>Hey community,</P> <P>We have a dual ISP environment, when one is used as a backup if the primary line stops working.</P> <P>I'm wondering what would be the best approach to configure HA in this situation (on the VR). I did it with path monitoring as it seems much simpler and straight forward. But can't decide if BGP is the better option for this scenario.</P> <P>&nbsp;</P> <P>Thanks!</P> Sun, 24 Mar 2024 09:41:26 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/path-monitoring-vs-bgp/m-p/581466#M2875 Marisableb 2024-03-24T09:41:26Z https://live.paloaltonetworks.com/t5/next-generation-firewall/path-monitoring-vs-bgp/m-p/581639#M2885 <P>BGP would be simple in this scenario if you only care about outbound traffic. Take the default from both ISP and set the local preference on your primary higher than 100. You would want an import filter that only matches the default to protect in case the ISP does something silly.</P> <P>You probably already have the necessary NAT rules if you have it working with path monitoring.</P> <P>I find BGP to be more predictable with failover and failback.</P> <P>&nbsp;</P> Tue, 26 Mar 2024 01:00:49 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/path-monitoring-vs-bgp/m-p/581639#M2885 rmfalconer 2024-03-26T01:00:49Z