topic Re: Dual IPSEC tunnels load balanced between two endpoints in General Topics

Dual IPSEC tunnels load balanced between two endpoints

TonyDeHart — Wed, 13 Sep 2023 15:08:05 GMT

Is there a way to setup TWO IPsec tunnels using different paths (for instance, two different ISP's) and have them share the traffic load between the two vs having a primary and backup?

I'm aware we can setup two tunnels and use path monitoring to fail over from one tunnel to the other but is there a way to have two or more tunnels and have the traffic load balanced and still function should one path go down?

Right now I'm anticipating we'll need a number of additional routes added to our route table for a backup path with duplicate routes but different metrics between tunnel.1 and tunnel.2 but I'd rather have address X be the next hop and then X forwards to tunnel.1 or tunnel.2 to utilize both paths so one isn't sitting idle.

Bottom line is we just want to utilize all the bandwidth we have available but maintain some failover capability should a path drop.

FYI this would be for PAN-OS 10.2.

Re: Dual IPSEC tunnels load balanced between two endpoints

seb_rupik — Wed, 13 Sep 2023 15:15:03 GMT

Hi there,

Assuming identical prefixes are being made available by both tunnels, then enabling ECMP within the Virtual Router will load balance traffic between equal costs paths.

Keep in mind that this is per flow load balancing, so you will never get a 50/50 split in bandwidth utilization.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/ecmp/configure-ecmp-on-a-virtual-router#id7b41dd6b-dcfb-429c-adb1-b955cb15a9c7

cheers,

Seb.

Re: Dual IPSEC tunnels load balanced between two endpoints

TonyDeHart — Wed, 13 Sep 2023 16:21:54 GMT

I'm probably being stupid so I apologize but what is meant by "prefixes"? You mean the subnet prefixes such as /16, /24, etc?

Re: Dual IPSEC tunnels load balanced between two endpoints

seb_rupik — Wed, 13 Sep 2023 17:32:01 GMT

Hi there,

In this context the network prefix referees to the subnet ID and netmask, ie 10.0.0.0/8.

Once you have enabled ECMP, and are advertising prefixes by say BGP, you will want to have two entries for each prefix in the BGP RIB, both with the same attributes and therfore same metric. Both will then appear in the routing table and the palo will load balance flows across the two tunnels.

Cheers,

Seb.