Static route to IPSec peers with dynamic IPs

Carracido — Thu, 31 Aug 2023 15:39:43 GMT

Hello Community!

We have 2 external interfaces, eth_1 holding the default 0.0.0.0/0 route and eth_2

We would like to use external interface n2 to build IPSec tunnels whose peers have dynamic public IP.

Is there a way to route the traffic to these dynamic peers over eth_2 without having to use default route over eth_1?

Thank you!

Re: Static route to IPSec peers with dynamic IPs

TomYoung — Thu, 31 Aug 2023 16:56:56 GMT

Hi @Carracido ,

If your VPN peers will be dynamic, you will need a default route to send traffic to them. If you only want to use eth1/2 for VPN traffic, the following solution may work.

Enable ECMP with Symmetric Return.
Select Weighted Round Robin with weights of 100 for eth1/1 and 0 for eth1/2.
Configure your dynamic IPsec peers to connect to eth1/2.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/ecmp/ecmp-load-balancing-algorithms

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0

Thanks,

Tom

topic Re: Static route to IPSec peers with dynamic IPs in General Topics

Static route to IPSec peers with dynamic IPs

Re: Static route to IPSec peers with dynamic IPs