Request Advice – BGP Failover Route-Based IPsec VPN With WatchGuard (WG)

PATECHENG — Tue, 18 Nov 2025 22:23:31 GMT

Hi Everyone,

I’m looking for guidance on the best-practice way to set up redundant route-based VPN tunnels using BGP between a Palo Alto firewall (PA-VM) and a WatchGuard firewall. The goal is to implement primary/secondary failover with dynamic routing instead of static proxy-ID tunnels.

Environment

Palo Alto: PAN-OS 10.x VM-Series
WatchGuard: Firebox running latest firmware
Topology:
- Two IPsec tunnels (Primary + Secondary)
- Each terminates on different external IPs on both sides
- Using Route-Based VPN on Palo Alto (tunnel.x interfaces)
- Using Tunnel Interfaces / VTI-equivalent on WatchGuard
Goal:
- Run BGP between PA <--> WG
- Advertise internal subnets
- Achieve seamless failover when one IPsec tunnel goes down
- Avoid static proxy IDs and manual failover

Current Status

I can bring up an IPsec SA on each tunnel individually using static proxy IDs.
Route-based tunnel (without proxy IDs) also comes up.
However, traffic flow between the subnets is inconsistent unless proxy IDs are manually configured.

Please advise if you have any specific article to configure this setup on PA VM and Watchguard Model M670

Thanks in advance for any guidance. I want to ensure this design is implemented cleanly and follows best

topic Request Advice – BGP Failover Route-Based IPsec VPN With WatchGuard (WG) in Next-Generation Firewall Discussions

Request Advice – BGP Failover Route-Based IPsec VPN With WatchGuard (WG)

Environment

Current Status