ISP Failover with dual Dynamic Public IPs?

Bill-Jerome — Thu, 27 Oct 2022 14:31:43 GMT

Hello,

I have two ISPs with Dynamic Public IPs. Is there a way to setup ISP failover?

Thanks,

Bill

Re: ISP Failover with dual Dynamic Public IPs?

TomYoung — Fri, 28 Oct 2022 01:36:04 GMT

Great question. I don't think it can be done with 1 NGFW because both static route path monitoring and PBF require a next hop to be configured. As I understand your scenario, your default routes are learned dynamically. However, with 2 NGFWs, you could enable Path Monitoring with 1 ISP on each NGFW. If you wanted to load balance between the two, it can be done but would be complicated. Primary/Standby would be the easiest scenario.

It is very important that you use multiple Internet IP addresses and set your Failure Condition to all so that if one Internet server goes down you do not fail over.

Thanks,

Tom

Edit: How often do your IP addresses change? You could do it with 1 NGFW and update your next hops whenever the IP address changes.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLL8CAO

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/policy-based-forwarding/use-case-pbf-for-outbound-access-with-dual-isps

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/device/device-high-availability/ha-link-and-path-monitoring

Re: ISP Failover with dual Dynamic Public IPs?

Bill-Jerome — Fri, 28 Oct 2022 03:29:40 GMT

Thanks for the feedback. I was thinking about the next hop option too but was hoping for a way to use a FQDN for the next hop but that seem like wishful thinking. 🙂

Thanks,

Bill

topic ISP Failover with dual Dynamic Public IPs? in Next-Generation Firewall Discussions

ISP Failover with dual Dynamic Public IPs?

Re: ISP Failover with dual Dynamic Public IPs?

Re: ISP Failover with dual Dynamic Public IPs?