topic Re: Creating tunnel monitoring profile between PA-3220 to Meraki SDWAN Cisco in General Topics

Creating tunnel monitoring profile between PA-3220 to Meraki SDWAN Cisco

ChandrashekharD — Sat, 03 May 2025 14:04:42 GMT

Hi Friends,

Our end customer wants to set up tunnel monitoring profile between a PA-3220 firewall and a Cisco Meraki SD-WAN device. Although an IPsec tunnel has already been established between the Palo Alto and the Meraki SD-WAN, we need to determine whether failover will occur automatically if one tunnel goes down, or if tunnel monitoring needs to be configured.

If tunnel monitoring is required, how can we configure a tunnel monitoring profile between the PA-3220 and the Meraki SD-WAN?. Kindly suggest me

Regards,

Chandrashekhar

Re: Creating tunnel monitoring profile between PA-3220 to Meraki SDWAN Cisco

TomYoung — Sun, 04 May 2025 17:59:05 GMT

Hi @ChandrashekharD ,

If you have a static route to the IPsec tunnel interface, the VPN will NOT fail over without tunnel monitoring. With regard to tunnel monitoring, the inside address of the Meraki should work fine. You want to set the Action in the tunnel monitoring profile to Fail Over.

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-tunnel-monitoring/define-a-tunnel-monitoring-profile#id65829b80-de86-4094-bd4f-96a41cff629f

Thanks,

Tom