topic Re: Dual ISP Failover with site to site VPNs in General Topics

Dual ISP Failover with site to site VPNs

Evahi21 — Thu, 21 Oct 2021 04:49:02 GMT

Hey everyone,

Just started with Palo and was researching the optimal way of configuring ISP failover to include automatic failover of site to site tunnels.

Is there a reason to use PBF over static route removal?

Based on the reading date I was doing today, SRR appears less convoluted than PBF and seems the most similar to Cisco's SLA configuration which worked well for me before.

omegle

Thanks

Re: Dual ISP Failover with site to site VPNs

OtakarKlier — Wed, 13 Oct 2021 17:23:06 GMT

Hello,

I have done this many times. First I setup VPN connections via both ISP's. Then I create OSPF adjacencies between the two VPN endpoints. I then use metrics so that I force the traffic down the VPN tunnel I choose as primary and secondary. So for the secondary i would choose a metric such as 5000, this makes sure the primary tunnel is the preferred one.

I have also used Policy based forwarding to accomplish the same thing. IT all depends on which one you are most comfortable with.

Regards,

Re: Dual ISP Failover with site to site VPNs

TomYoung — Wed, 13 Oct 2021 23:32:20 GMT

Hi @Evahi21 ,

If you have at least 1 public IP address advertised to both ISPs, I would use a loopback for a single VPN tunnel. That design is by far the simplest, but requires a separate public subnet than the ones on the interfaces.

Thanks,

Tom

Re: Dual ISP Failover with site to site VPNs

PAdekeye — Tue, 16 Jul 2024 20:29:56 GMT

Hi,

I am having similar issue, but I need more guidelines. I have two ISPs and I want each of them to be used for primary and secondary between Palo Alto and Cisco ASA. From the ASA side, I kept have issue each time I try to bring up the two tunnel at the same time. So far I can only have one tunnel up and when the primary is down, I have to delete the tunnel for it on the ASA side and have only the secondary tunnel used at a time.

Is there are a way to configure this correctly?

Please advise from your experience.

Re: Dual ISP Failover with site to site VPNs

OtakarKlier — Wed, 17 Jul 2024 18:58:21 GMT

Hello,

So you want one tunnel one each ISP? This should be possible as long as the public IP's you are using on the PA are different. I recall Cisco having troubles when you try to connect two Tunnels to the same device on the other side but could be remembering this incorrectly.