topic Re: Dual ISP Ipsec/BGP tunnels to Azure in General Topics

Dual ISP Ipsec/BGP tunnels to Azure

mdsgn1 — Wed, 17 Jan 2024 12:57:02 GMT

Has anyone created ISP failover for tunnels to Azure gateway?

We have PA440 devices with two ISPs configured. Local networks are switched with path monitoring if ISP1 goes down.

We want the same for the IPSec tunnel to Azure.

From Azure documentation it seems that BGP failover can be used with different AS, with lower path having higher priority.

Is creating two virtual routers on PA the only way?

Re: Dual ISP Ipsec/BGP tunnels to Azure

Raido_Rattameister — Wed, 17 Jan 2024 18:47:06 GMT

You don't need to have multiple virtual routers.

Every peer under Peer Groups can have different Peer AS.

Re: Dual ISP Ipsec/BGP tunnels to Azure

OtakarKlier — Wed, 17 Jan 2024 22:16:53 GMT

Hello,

Yes, I have setup Policy Based Forwarding so that I force the traffic down the path I think is primary and if it goes down, It goes to the virtual router route of the other path.

Hope that makes sense.

Re: Dual ISP Ipsec/BGP tunnels to Azure

mdsgn1 — Fri, 19 Jan 2024 11:25:20 GMT

Thank you both for the replies! I will try to go for AS solution to have BGP choose the routing, as we need the routing to work both ways and Azure seems to work that way with lowest AS being the default route. Will report here when I try it out