topic Re: VPN IPSEC secondary peer in General Topics

VPN IPSEC secondary peer

ChristianBolelli — Fri, 25 Mar 2022 14:00:53 GMT

Hello,

I have a vpn ipsec in production, now I have to add a secondary remote peer.

It's my first time I have to configure a 2nd peer.

If I understood well I can't simply add a seocndary peer to the VPN but I have to configure a new psec but the difference is the static route related the remote network.

Example I should have:

Remote net: 10.1.0.0/24

Route 1 10.1.0.0/24 metric 10 Tunnel.1

Route 2 10.1.0.0/24 metric 20 Tunnel.2

If the primary peer stop responding how I can turn off the Route 1?

The tunnel.1 and .2 don't have an ip and the inside int of the PA it's not included in the local network

Can I add an ip to Tunnel.1 like 192.168.1.1 and nat it with the external IP of the PA and set the Path monitor of the "Route 1" like
Source:192.168.1.1
Destination: Primary Peer
So the Route 1 ping the Primary peer If the peer stop responding the PA remove from the routing table the Route 1 and the Secondary VPN start working because the Route 2 it's the only active.

Re: VPN IPSEC secondary peer

SutareMayur — Fri, 25 Mar 2022 14:36:05 GMT

Hi @ChristianBolelli ,

Yes, you need to have separate VPN tunnel with secondary peer IP and you need to assign the IP to the tunnel interface. You just need to make sure that the IP that you are assigning to the tunnel interface should be from your local network which is part of tunnel encryption domain. Basically that source IP should be reachable towards the destination servers over tunnel. If you are doing NAT for the existing tunnel traffic, then you need to do NAT for tunnel interface IP also. This traffic will travel till destination via tunnel.

Once you have this set, you can enable the path monitoring on the tunnel.1 route i.e. Route 1 10.1.0.0/24 metric 10 Tunnel.1 and take one of the ICMP responding server from peer side to add it under path monitoring. Once Primary tunnel fails, configured destination server will stop responding to ICMP and once path monitoring fails, Palo Alto will remove route towards tunnel.1 from FIB. And traffic will then start sending to the secondary tunnel i.e. tunnel.2

Here, I have considered that you are trying to configure two tunnels (Primary & Secondary) for same encryption domain from your Palo Alto.

Hope it helps!

Re: VPN IPSEC secondary peer

ChristianBolelli — Fri, 25 Mar 2022 14:42:48 GMT

Hello,

so the Path monitor MUST pass through the tunnel? In my example the Tunnel.1 ip shoud be natted with the PA outside interface and reach the public ip of the remote peer. The idea is to monitor the public ip and not and internal resources.

Re: VPN IPSEC secondary peer

SutareMayur — Fri, 25 Mar 2022 15:26:04 GMT

Hi @ChristianBolelli Will your peer allow ICMP traffic on their public IP ?

Also in addition to this - If they allows and you configure but it won't help you in some scenarios like given below -

Your tunnel having issues like Phase-1 and/or Phase-2 is down. In this case, peer end public IP may respond to ICMP but tunnel resources may become unreachable.

Re: VPN IPSEC secondary peer

ChristianBolelli — Wed, 06 Apr 2022 08:41:56 GMT

Hello,

Yes they allow icmp traffic

I have now a lab. I've set an ip on the Tunnel.1 and a Path monitor as below:

Tunnel.1 192.168.1.1/32

Static route

Route1
10.10.10.0/24 interface Tunnel.1
Path monitor
Src: 192.168.1.1/32
Dst: Remote Peer ip

On Security rule
Src:192.168.1.1/32
dst: Remote-PeerIP

Application: Ping/icmp

Nat
original source: 192.168.1.1/32
Original dst:Remote-PeerIP
Translated src: Dynamic ip and port. with the Palo alto Public IP

Translated dst: original

From CLI

ping source 192.168.1.1 host Remote-PeerIP
Answers as expected and we capture the traffic on test remote ASA and we see the icmp packets coming from Palo Alto public ip.

But on Path monitor tab still in "down" state.

Re: VPN IPSEC secondary peer

ChristianBolelli — Thu, 07 Apr 2022 08:29:04 GMT

Hello,

I'm trying to understand if it's possible to monitor the Remote Peer IP(Customer request) instead of a resource inside the tunnel IPSEC.
So the ip assign to Tunnel.1 it not included in the ProxyID because I want to ping the Peer- ip
Via CLI the ping works:

PA>ping source "Tunnel.1-IP" host "Remote-Peer-IP"
But with the same data on path monitor it fails.

Re: VPN IPSEC secondary peer

ChristianBolelli — Thu, 07 Apr 2022 08:44:24 GMT

To make short a long story, I want to know if I can define a Secondary VPN that switches when the Remote Peer IP go down because the Customer want to avoid to monitor a resource inside the VPN.
(Like on the ASA where we can simply set the secondary peer and it works without any other conf)

Re: VPN IPSEC secondary peer

OtakarKlier — Thu, 07 Apr 2022 16:41:55 GMT

Hello,

If you have say OSPF setup on both VPN endpoints, it should see the down link and route around it.

Regards,