topic Re: Dual ISP with VPN in General Topics

Dual ISP with VPN

MikeC — Thu, 20 Sep 2018 01:04:00 GMT

I'm working on configuring a branch office firewall with two ISPs and Site-to-Site VPN to our data center. The data center side has only 1 ISP connection

I'm reviewing this article again, as I've used it in the past.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774

It's been a while since I've done this setup, but something doesn't seem right. I get the two VR idea, since the traffic sourcing from the firewall does not use PBR. My issue is with the default route.

Let's examine

Interface configuration:

Configure two interfaces:

Eth 1/3: 10.185.140.138/24 (connection to ISP1) in the untrust zone

Eth 1/4: 10.80.40.38/24 (connection to ISP2) in the untrust zone

Virtual routers:

There are two virtual routers:

VR1: Primary (ISP1) (Ethernet1/3)

VR2: Secondary (ISP2) (Ethernet1/4)

On Primary VR1, they have a default route pointing to the gateway of ISP1 0.0.0.0/0 10.185.140.1. Then, on Secondary VR2, they do not add a default route. I also saw a post in the comments that you need a static default route configured on both VR1 and VR2

I believe both are incorrect, unless I'm missing something. If you add a static route pointing to Primary ISP1 on VR1, it will cause issues with failover, even if you also have a default route on VR2.

I'm thinking they meant to create the default route to the next hope for ISP2. If correct, wouldn't that be on VR2?

Re: Dual ISP with VPN

theonewhoknocks — Thu, 20 Sep 2018 10:11:00 GMT

Hi @MikeC,

We're running this setup on one of our sites.
Both VR has default routes pointing to each individual ISP GW.

VR1 has my internal LAN segments and ISP1 interface. VR2 has only ISP2 interface. VR1 has a backup default-route pointing to next VR (VR2)

Re: Dual ISP with VPN

OtakarKlier — Thu, 20 Sep 2018 14:41:46 GMT

Hello,

This can be accomplished with 1 VR and a PBF rule or dynamic routing (with weighted routes). Since both tunnels are up but you will only be using one at a time (assumption). A 1 VR solution works well.

Regards,

Re: Dual ISP with VPN

reaper — Fri, 21 Sep 2018 11:16:44 GMT

there's a picture of the routes on the secondary-vr further down in the article that shows it does have a default route: