topic Re: How can I get dual ISP with DUAL IPSEC Tunnel to work with static routes and no tunnel monitor? in General Topics

How can I get dual ISP with DUAL IPSEC Tunnel to work with static routes and no tunnel monitor?

junior_r — Sun, 12 Feb 2017 06:23:14 GMT

HI,

How can I get dual ISP with DUAL IPSEC Tunnel to work with static routes and no tunnel monitor? I want the IPSEC tunnel to only failover when the primary circuit goes down. Problem I am having is the static route metrics is not taking over when the primary ISP and primary IPSEC tunnel goes down. Metric is 10 for primary tunnel and 20 for backup tunnel.

Thanks

Re: How can I get dual ISP with DUAL IPSEC Tunnel to work with static routes and no tunnel monitor?

pulukas — Sun, 12 Feb 2017 17:12:43 GMT

My recollection is that you really have to use VPN monitor in this scenario because without it the tunnel interface does not go down and therefore your primary route is never removed from the routing table.

Re: How can I get dual ISP with DUAL IPSEC Tunnel to work with static routes and no tunnel monitor?

OtakarKlier — Mon, 13 Feb 2017 23:46:13 GMT

Hello,

I have always looked at the type of site it is, i.e. if its a stub then I used Policy Based Forwarding (but you need a monitor) and a static route for the secondary. That is if primary goes down, the PBF doesnt take affect and so the route takes the static route. You can also possible accomplish this with dynamic routing such as OSPF on both sides and then weigh the routes accordingly, e.g. higher on the secondary, etc.

Hope that points you in the right direction.

Regards,

Re: How can I get dual ISP with DUAL IPSEC Tunnel to work with static routes and no tunnel monitor?

Remo — Tue, 23 May 2017 21:20:00 GMT

As @pulukas already mentionned, some kind of monitoring is needed. Without it the primary route will stay in your routing table.
With PAN-OS 8 ther is also a possibility to configure a monitor directly for the static route: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/networking/configure-path-monitoring-for-a-static-route.html