topic Re: ikev2 site to site VPN to sites with multiple public ip addresses(used for failover) in Panorama Discussions

ikev2 site to site VPN to sites with multiple public ip addresses(used for failover)

msdphi — Mon, 05 Feb 2024 21:35:40 GMT

for a client, i created these many tunnel interfaces for each of their sites. Now, for all these sites, they have 2-3 public ip addresses(for failover purposes). So, will i have to create new tunnel interfaces or should I just create new Ike gateways and ipsec tunnels and point them to the tunnels which I created earlier(shown on the screenshot below)? Please help

Re: ikev2 site to site VPN to sites with multiple public ip addresses(used for failover)

OtakarKlier — Mon, 05 Feb 2024 22:46:12 GMT

Hello,

I think your answer would depend on how you plan to use the tunnel interfaces. You can assign multiple IP's to a singe interface. However for me, I use the interfaces for OSPF routing and to see if the tunnel is up, via 3rd party monitoring since the tunnels connect via different providers.

Regards,

Re: ikev2 site to site VPN to sites with multiple public ip addresses(used for failover)

msdphi — Tue, 06 Feb 2024 17:51:58 GMT

I want to know how to configure policy based site to site VPN from our Palo Alto to a site which has a watchguard firewall and has 3 public ip addresses(used for failover).

Re: ikev2 site to site VPN to sites with multiple public ip addresses(used for failover)

OtakarKlier — Tue, 06 Feb 2024 18:05:31 GMT

Hello,

Is a watchguard a route based or zone based firewall? Palo Alto is route based.

Regards,

Re: ikev2 site to site VPN to sites with multiple public ip addresses(used for failover)

msdphi — Tue, 06 Feb 2024 18:28:03 GMT

I am not sure about that. That is on the client's side.

Re: ikev2 site to site VPN to sites with multiple public ip addresses(used for failover)

msdphi — Tue, 06 Feb 2024 18:32:26 GMT

I am just configuring on panorama. I have already configured VPN to their primary public IP. I am not sure if I can point the same tunnel to the newly created ike gateways and ipsec tunnels for their branch sites.

Re: ikev2 site to site VPN to sites with multiple public ip addresses(used for failover)

OtakarKlier — Tue, 06 Feb 2024 18:37:29 GMT

Hello,

You should be able to, however make sure your routing is set so that its not going to use multiple tunnels unless you are using ECMP.

Regards,