topic Re: Palo Alto device is wrongly directing the traffic . DUAL ISP IPSEC VPN issue in General Topics

Palo Alto device is wrongly directing the traffic . DUAL ISP IPSEC VPN issue

mhm_ameen — Tue, 06 Sep 2022 09:57:44 GMT

we have two dynamic ISP in single VR with ECMP and we have setup dual IPSEC VPN tunnels towards single public IP to other paloalto . our issue that PA wrongly forwarding traffic , ISP 2 is using MAC address of ISP1 when initiating VPN traffic to public ip address of second FW.

Moreover check the source MAC address !

show interface ethernet1/3 [ ISP1]

--------------------------------------------------------------------------------

Name: ethernet1/3, ID: 18

MAC address:

Port MAC address 00:1b:17:00:01:12

Operation mode: layer3

Interface IP address: 172.20.2.250/24

show interface ethernet1/2 [ ISP2]

MAC address:

Port MAC address 00:1b:17:00:01:11

Operation mode: layer3

Interface IP address: 172.20.3.250/24

Re: Palo Alto device is wrongly directing the traffic . DUAL ISP IPSEC VPN issue

BPry — Wed, 07 Sep 2022 13:28:37 GMT

@mhm_ameen,

Are you forcing symmetric return?

Re: Palo Alto device is wrongly directing the traffic . DUAL ISP IPSEC VPN issue

mhm_ameen — Wed, 07 Sep 2022 13:32:30 GMT

Yes enabled and also enable strict source path as well same even trying with 2 VR and PBF same issue we are in 10.1.6 which even we upgraded to from 10.1.5

Re: Palo Alto device is wrongly directing the traffic . DUAL ISP IPSEC VPN issue

BPry — Thu, 08 Sep 2022 20:52:49 GMT

@mhm_ameen,

Interesting. At least from my end, I would open a ticket so that TAC can review your actual configuration and confirm if something regarding routing is simply setup incorrectly, or if you're running into some undocumented bug. I'm guessing it's not a bug due to this being a regular setup, but maybe it's only present when select features are enabled or something like that.

Re: Palo Alto device is wrongly directing the traffic . DUAL ISP IPSEC VPN issue

Andreikin — Sun, 28 Jan 2024 18:52:39 GMT

hello @mhm_ameen, have you got to the bottom of this? Looking at it from 10.2.x perspective I see that 'strict source path' is working fine on it - VPN traffic is tied to correct physical interfaces, but if you have path monitoring for static route you use as default for ISP1 for example and it will fail and be removed from routing table, then you might expect Palo to initiate VPN1 over different interface.