topic Re: Second backup endpoint for IPSEC tunnel in General Topics

Second backup endpoint for IPSEC tunnel

OzkanOzdil — Wed, 31 Jul 2024 11:04:16 GMT

How do I best configure a backup IPSEC endpoint in an IPSEC tunnel if the primary endpoint goes down?

NOTE : Palo Alto on both sides

Re: Second backup endpoint for IPSEC tunnel

reaper — Wed, 31 Jul 2024 11:18:53 GMT

you can use an FQDN instead of an IP and then rely on dynamic DNS to switch the tunnel over, or you can create a second ike gateway and ipsec tunnel with secondary IP addresses (2 active tunnels) and use policy based forwarding for example to pick the preferred tunnel

Re: Second backup endpoint for IPSEC tunnel

OzkanOzdil — Wed, 31 Jul 2024 12:57:57 GMT

It would be more convenient to do it using IP addresses (2 active tunnels), but when the tunnels are down, will it automatically switch to the other one or do I have to do it manually?

Is there a document I can review about this?

Re: Second backup endpoint for IPSEC tunnel

reaper — Fri, 02 Aug 2024 10:16:35 GMT

once both tunnels are established, you do need to set up tunnel monitoring to make sure the tunnel goes _down_ when the remote side is disconnected. this will bring down the tunnel and impact routing. additionally you can have path monitoring in your routes or PBF that also monitor if a path is still available and reroute packets if the primary path is unavailable