topic Re: PanOS6 - Redundant VPN Tunnels in General Topics

PanOS6 - Redundant VPN Tunnels

gafrol — Tue, 28 Jul 2015 16:11:50 GMT

Hi all,

I cannot find an easy solution to this problem of having an automatic failover once the primary VPN tunnel goes down. Goal is to have both Tunnels up and runnig at the same time, once the primary VPN tunnel dies it will automatically use the other remaining backup tunnel. Remote Peer IP (195.186.255.x) stays the same for both tunnels. Currently the VPN is up and running through the Primary VPN Path only.

Any ideas ? Thanks

Currently there is one VR with a static route to 195.186.255.x via SC Router 1. The LAN behind VPN EP Cisco is routed into Tunnel.1 interface.

Re: PanOS6 - Redundant VPN Tunnels

pankaku — Tue, 28 Jul 2015 16:38:05 GMT

Please refer to following document

How to Configure a Palo Alto Networks Firewall with Dual ISPs and Automatic VPN Failover

Re: PanOS6 - Redundant VPN Tunnels

santonic — Wed, 29 Jul 2015 10:29:49 GMT

Fail-over tunnel monitoring profile on both tunnels, 2 static routes with different metric for network behind VPN, each directing into one tunnel interface.

Re: PanOS6 - Redundant VPN Tunnels

gafrol — Wed, 29 Jul 2015 12:03:00 GMT

Still does not solve the Tunnel remote Peer IP Problem. Cannot have multipath routes to same remote peer IP at the same time, except for PanOS7 and ECMP.

I guess we need to have a second remote Peer IP Address in order to have both tunnels up at the same time.

Re: PanOS6 - Redundant VPN Tunnels

santonic — Wed, 29 Jul 2015 12:34:08 GMT

Ahh, thought you already have both tunnels up. I usually do such scenario with 3 VRs, one for each ISP or external interface (so you can have multiple default routes) and one VR for local interfaces including tunnel interfaces. Then you can have both tunnels up all the time.

Re: PanOS6 - Redundant VPN Tunnels

gafrol — Wed, 29 Jul 2015 12:43:24 GMT

Interesting approach thank you. I will give it a try.