topic Re: IPSec tunnel as backup link of MPLS connection in General Topics

IPSec tunnel as backup link of MPLS connection

jakub_gniazdowski — Fri, 22 Feb 2013 11:42:54 GMT

Hi,

we have MPLS link between two sites. Right now I want to setup backup link with IPSec tunnel. schema of network connection is as on picture.

please help me to configure Palo Alto device to monitor MPLS link and switch to IPSec tunnel when MPLS link will be down.

Switch on right site has IPSLA ready that check connection to MPLS router and change routing automatically to PA.

Palo Alto has two routing record for the same sub net with different metric and adm distance but it don't swap to IPSec automatically. Please tell me how I should configure PA to support this scenario without my interaction ?

What should I use PBF, redistribution profiles under VR - static, add one VR more, Monitor tunnel?

Thank you for advice!

Re: IPSec tunnel as backup link of MPLS connection

Retired Member — Wed, 27 Nov 2013 10:56:30 GMT

Hi,

I think you should use PBF for this since only by using PBF you can achieve automatic failover. Unless you have a dynamic routing protocol running in your MPLS networks, there is no way that the firewall knows that the route to your MPLS cloud was down.

Re: IPSec tunnel as backup link of MPLS connection

Phoenix — Wed, 27 Nov 2013 12:41:23 GMT

Hello Jakub,

Yes we will have to use PBF to have auto failover if the primary link is failed.

In PBF rule we set the primary link ( in your case it is MPLS path ). PBF rules are given priority over default routes and security rules. If the PBF fails then it would take the default static route to the tunnel for backup path.

Below are some doc suggestions to understand and customize your implementation.

How to Setup a Palo Alto Networks Firewall with Dual ISPs and Automatic VPN Failover

Dual ISP Branch Office Configuration

Thanks

Re: IPSec tunnel as backup link of MPLS connection

VinceM — Wed, 27 Nov 2013 19:01:02 GMT

Hi,

Fully agree with Phoenix. Just be sure that the juniper on remote site be able to send traffic in VPN too (in case of vpn failure) alse ... it will fail 🙂

Hope help.