topic Re: Site to site VPN between PA & Azure || Failover / HIgh availability in General Topics

Site to site VPN between PA & Azure || Failover / HIgh availability

S.Kamtaria — Thu, 09 Jul 2026 20:09:54 GMT

We have configured two Site-to-Site VPN tunnels between our Palo Alto firewall and Azure VPN Gateway to provide redundancy and high availability.

However, we are encountering an issue where we are unable to keep both VPN tunnels active simultaneously:

When both VPN tunnels are up, connectivity between our on-premises environment and Azure becomes unstable or completely fails.
If we disable one of the VPN tunnels and leave only a single tunnel active, connectivity works normally without any issues.
We would like to maintain both VPNs in an active state for redundancy and failover purposes, but currently this setup is causing routing/connectivity problems.

We are looking for guidance on what configuration areas we should review

Re: Site to site VPN between PA & Azure || Failover / HIgh availability

S.Kamtaria — Thu, 09 Jul 2026 20:47:32 GMT

Re: Site to site VPN between PA & Azure || Failover / HIgh availability

S.Kamtaria — Thu, 23 Jul 2026 15:58:50 GMT

Any insights or guidance would be greatly appreciated

Re: Site to site VPN between PA & Azure || Failover / HIgh availability

OtakarKlier — Thu, 30 Jul 2026 15:33:32 GMT

Hello,

Setup a tunnel monitor. It will send pings down both tunnels so that they should stay up.

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-tunnel-monitoring

Regards,

Re: Site to site VPN between PA & Azure || Failover / HIgh availability

rosaliedavid563 — Sat, 01 Aug 2026 10:51:32 GMT

The issue is likely asymmetric routing or duplicate routes. Check both tunnel IPs, BGP peers, route metrics, ECMP settings, and NAT/security policies. With static routing, keep one tunnel primary and set the second as backup with tunnel monitoring. BGP is usually the better option for automatic failover.