topic Re: Multiple acitve ISP's in General Topics

Multiple acitve ISP's

bwilliams2 — Thu, 12 May 2011 17:35:07 GMT

We would like implement multiple active ISP's. There would be two ISP with each being a different provider.

It appears you can have a redundant setup with multiple ISP, but can you have two active?

Re: Multiple acitve ISP's

bpappas — Thu, 12 May 2011 17:41:42 GMT

@bwilliams2:

You can certainly have two active ISP connections and route traffic to each ISP using Policy Based Forwarding and/or dynamic routing protocols.

What are you hoping to accomplish with your two ISP setup?

-Benjamin

Re: Multiple acitve ISP's

cityofkingsland — Thu, 12 May 2011 18:50:00 GMT

Will you be setup on BGP multihoming or will you just have two 0.0.0.0/0 routes?

Re: Multiple acitve ISP's

bwilliams2 — Thu, 12 May 2011 19:23:36 GMT

@bpappas:

The goal is to ensure we are "always" connected. With the shift to the cloud we do not want to limit our connection to one ISP.

@cityofkindsland

I am not sure about the routing at this point. I think I am going to push for a failover connection as apposed to an active-active connection. I am hoping to find an ISP that will allow us to use them on a retainer basis and only pay full price when we reach X amount of data or something along though lines.

Thanks.

Re: Multiple acitve ISP's

cityofkingsland — Thu, 12 May 2011 19:30:55 GMT

failover is a great way to go! cost savings are great compared to paying for another full service line.

to do this you will go to your virtual router, enter in a 0.0.0.0/0 route out to your failover line with a higher administrative distance than that of your existing link (which should be already set to be 1)

This tells the router use the primary link until it it no longer reachable, after that link goes down use backup link.

Good Luck, let me know if you need anymore help configuing this!

Re: Multiple acitve ISP's

bwilliams2 — Wed, 07 Sep 2011 15:54:01 GMT

The plan now is move forward with dual ISP's and have both active and load balanced.

Is it possible to load balance outgoing connections?

Re: Multiple acitve ISP's

migration — Wed, 07 Sep 2011 16:35:19 GMT

Currently there is no way to load balance outgoing connections.

You can use PBF for failover but nothing more.

Re: Multiple acitve ISP's

KGC — Wed, 07 Sep 2011 16:41:59 GMT

I think with PBF you can only load-balance manually, e.g. choose which (apps/source/destinations) to send via which route. We looked into this in the past and realized that to do this properly you need another device, like an F5 box.

Re: Multiple acitve ISP's

Retired Member — Thu, 08 Sep 2011 05:52:54 GMT

Proper load balancing would require ECMP or per-packet/per-flow load balancing. PAN does not support that at this time. So that means unless you want to use PBF to selectively route traffic over one link or the other, you cannot utilize both ISP links at same time.

-Richard

Re: Multiple acitve ISP's

Retired Member — Fri, 06 Nov 2015 02:41:54 GMT

Helo rkim...

Is is still not possible to implement dynamic load balancing with PAN? What about ECMP in PAN OS 7.0.3?

Even when Palo Alto Networks is a visibly higher security solution, many of our competitors offers load balancing and fault tolerance with their NGF boxes.

Best Regards

Re: Multiple acitve ISP's

kiwi — Fri, 06 Nov 2015 09:23:16 GMT

Hi,

As of PanOS 7.0, ECMP is indeed supported :

https://paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/networking-features/ecmp.html#60884

Regards,

-Kim.

Re: Multiple acitve ISP's

MatiusGatot — Wed, 06 Sep 2017 10:30:21 GMT

ECMP in OS 8 is good with path monitoring that can monitor heartbeat of multiple link .

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/networking/static-route-removal-based-on-path-monitoring#_50067