topic Re: VPN FAILOVER in General Topics

VPN FAILOVER

Radmin_85 — Thu, 31 Aug 2017 13:20:38 GMT

there are two offices.branch and head.in head office there is palo alto networks NGFW and in branch office it is Kerio Control.in each office there are 2 connections two different ISPs.

Is it possible to make VPN tunnel failover between these offices by kerio control in one side and palo alto networks in orher?

Re: VPN FAILOVER

9t89m8fu — Thu, 31 Aug 2017 14:08:44 GMT

Yes.

Re: VPN FAILOVER

BPry — Thu, 31 Aug 2017 14:21:40 GMT

@Radmin_85,

Were you looking for the details on how you would accomplish this or did you simply want to verify the PA could do this function?

Re: VPN FAILOVER

Radmin_85 — Thu, 31 Aug 2017 14:23:00 GMT

i want to know whether PA can do this function in conjuction with Kerio control?

Re: VPN FAILOVER

BPry — Thu, 31 Aug 2017 20:07:13 GMT

@Radmin_85,

I can't speak on the Kerio Control side as I don't know anything about them, but the PA can handle this perfectly fine and won't give you any issues once properly configured.

Re: VPN FAILOVER

Radmin_85 — Sat, 02 Sep 2017 15:17:30 GMT

can you give me some detailed technical info or source from PA side?

Re: VPN FAILOVER

pulukas — Sun, 03 Sep 2017 11:55:29 GMT

On PA the general feature for VPN failover is Tunnel Monitoring. This is described here.

https://live.paloaltonetworks.com/t5/Configuration-Articles/Dead-Peer-Detection-and-Tunnel-Monitoring/ta-p/61371

A fuller example of implementing VPN failover between two ISP is in this configuration example.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774

Re: VPN FAILOVER

Radmin_85 — Tue, 05 Sep 2017 08:09:32 GMT

it didnt work.we tried this issue.

we have to create two vpn tunnels between kerio and PA. One tunnel we can do but other one doesnt go up.there is no info in logs.tunnel just doesnt go up

Re: VPN FAILOVER

pulukas — Tue, 05 Sep 2017 09:37:13 GMT

You will need the logs from the responder for the reasons.

They are using different gateways right?

Re: VPN FAILOVER

Radmin_85 — Wed, 06 Sep 2017 07:54:35 GMT

yes both offices use different gateways.i mean they both have two separate connection to two different ISPs.you mean logs from Kerio side?

Re: VPN FAILOVER

pulukas — Wed, 06 Sep 2017 21:00:49 GMT

If you don't have logs for the vpn I am assuming the PA is the initiator. The best failure logs are on the responder side of the VPN negociation.

If you don't have access to that side logs, you can enable the cli option for more logs.

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-IPSec-VPN-connectivity-issues/ta-p/59187