topic Re: Tunnel monitoring between plao alto and policy based cisco vpn in General Topics

Tunnel monitoring between plao alto and policy based cisco vpn

Aaida — Fri, 21 Apr 2023 05:53:03 GMT

I am thinking about possibility of doing a tunnel monitoring from palo alto to cisco route vpn which is configured in policy based mode.

Do palo alto supports below configuration to do so.

1. Set up /32 IP in tunnel interface of palo alto

2. Configure tunnel monitoring to Peer IP of peer cisco.

Do this work?

Re: Tunnel monitoring between plao alto and policy based cisco vpn

S.Cantwell — Tue, 25 Apr 2023 13:27:38 GMT

Good Day

Yes the PANW supports tunnel monitoring to monitor the remote side of the tunnel.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/vpns/set-up-site-to-site-vpn/set-up-tunnel-monitoring

Re: Tunnel monitoring between plao alto and policy based cisco vpn

TomYoung — Tue, 25 Apr 2023 14:47:21 GMT

Hi @Aaida ,

As @S.Cantwell said, it will work. With regard to your second point, the "Peer IP" should not be the public IP address of the Cisco, but rather an IP address that is routed over the VPN, preferable a device that will never be turned off.

What is your intended purpose of tunnel monitoring, to keep the tunnel up or something else?

Thanks,

Tom

Re: Tunnel monitoring between plao alto and policy based cisco vpn

Aaida — Tue, 25 Apr 2023 14:53:05 GMT

Hello Tom,

My intention is to monitor tunnel and auto failover. So if we monitor peer Ip of cisco, we can achieve auto failover right

Re: Tunnel monitoring between plao alto and policy based cisco vpn

TomYoung — Tue, 25 Apr 2023 15:30:54 GMT

Hi @Aaida ,

Excellent. Yes, you can set the Tunneling Monitoring Profile to Fail Over, and when the IP is unreachable, it will shut down the tunnel interface and remove the routes to the tunnel. You will need to have an alternative path, another VPN tunnel or something.

Please stop saying "monitor peer IP." It sounds like you are talking about the public VPN peer IP address. That is not how it works. You need to monitor an IP address reachable via the VPN tunnel.

Thanks,

Tom

Re: Tunnel monitoring between plao alto and policy based cisco vpn

Aaida — Tue, 25 Apr 2023 16:11:37 GMT

Thank you so much Tom, so what about routers internal interface ip, we can monitor that right

Re: Tunnel monitoring between plao alto and policy based cisco vpn

TomYoung — Tue, 25 Apr 2023 16:21:27 GMT

Yes, sir!

Re: Tunnel monitoring between plao alto and policy based cisco vpn

Aaida — Tue, 25 Apr 2023 17:09:45 GMT

Thanks @TomYoung @S.Cantwell for your help.