topic IPsec tunnel Failover between Two PA in General Topics

IPsec tunnel Failover between Two PA

Pune_IT — Mon, 07 May 2018 09:19:17 GMT

I've two Palo Alto firewalls, PA-500 and PA-820.
My PA-500 is having 2 ISPs, so I've configured Tunnel monitoring as Failover on it. I think I've configured everything at right place on PA-500 which have 2 ISPs.
I'm not sure with the configuration at other end at PA-820 as my destination subnet is same, how should I configure same destination to go through single ISP PA to Dual ISP PA for tunnel Failover configuration at other end.

Re: IPsec tunnel Failover between Two PA

OtakarKlier — Mon, 07 May 2018 17:10:10 GMT

Hello,

What I do is use OSPF between the two so when the ISP's fail over, and the tunnel changes, the routes are updated. However you could setup a Policy Base Forwarding rule on the 820 and monitor the ISP A interface. I also use /32 addresses with static routes to make sure the systems monitor the proper path.

Hope that helps.

Re: IPsec tunnel Failover between Two PA

itwebadmin — Fri, 25 Jan 2019 16:11:22 GMT

I want to do the same thing from the sound of your description. Is there anything special you had to do once you specified you wanted to use failover? Where in the configuration do you configure the failover to point to the secondary vpn tunnel or does it failover to the secondary automatically since there are only two tunnels configured?

Re: IPsec tunnel Failover between Two PA

Raido_Rattameister — Fri, 25 Jan 2019 16:21:33 GMT

This can be achived with regular static routes.

Static routes have monitoring feature also on them.

Re: IPsec tunnel Failover between Two PA

itwebadmin — Fri, 25 Jan 2019 16:33:16 GMT

@Raido_Rattameister I have an ip address assigned to the tunnel interface on each side of the vpn tunnel. Example, tunnel.113 is assigned 1.1.1.1/32 and the other side, tunnel.17 is assigned 1.1.1.2/32. They're also advertising/receiving routes across the tunnel vial ospf. Would the static routes take the place of the ip addresses assigned to the ipsec tunnel ends? I'll read up on the configuration options you mentioned. Thanks!

Re: IPsec tunnel Failover between Two PA

Raido_Rattameister — Fri, 25 Jan 2019 16:42:45 GMT

I guess you are not using Cloudflare DNS if you use 1.1.1.1 in firewall config 🙂

https://1.1.1.1/

If you have OSPF configured already then go ahead with that. Not all smaller environments have dynamic routing so static routes could work as well monitoring tunnel failover. That was the reason I mentioned it.

Re: IPsec tunnel Failover between Two PA

OtakarKlier — Fri, 25 Jan 2019 17:45:26 GMT

Hello,

Also if you want to make sure all traffic goes down one tunnel rather than both, you can set the second tunnel interface metric to something like 10000. That way the traffic will prefer the first ISP and if there is a failover event, it'll go down the second.

Regards,