two Internetconnection IpSec build

clonesheep — Tue, 07 May 2019 15:08:14 GMT

Hello, I have two PAs and want to build IPSec tunnels between them. one PA A has a static IP. The other PA B has two internet connections. One with a static IP and one with a dynamic IP. Now I want to build two tunnels from device B to the A side. my two internet interfaces eth 1/4 has the IP 192.189.5.4 and the router behind it has the IP 192.168.5.1. What should my routing look like? Both interfaces are in the same default VR. There I have a route 0.0.0.0/0 on interface eth 1/1 where my main internet connection is. My other side where the tunnel should terminate is the 1.1.1.1 IP.
Don't really know right now.When my tunnel from eth 1/4 now start, it will go to the untrust zone of eth 1/1.

Where can I find helpful information?

Re: two Internetconnection IpSec build

OtakarKlier — Tue, 07 May 2019 18:42:41 GMT

Hello,

As for the VPN, here is the article you would want to read:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0

As for routing, you have several choices:

OSPF with one VPN path having a higher cost of say 10000

Static with route monitoring, .e.g the route will be removed if the far end IP is not reached

Policy based forwarding with monitoring, e.g. the PBF rule will not take affect is the far end IP is not reached.

The way I have done it in the past is assign IP to the Tunnel interfaces, like /30's and then make the far side /32 routing using static routing. So if the tunnel is down the IP is never reachable since its static routing and the other protocols are of lower value.

Hope this makes sense. Let me know if you would like clarification.

Cheers!

topic two Internetconnection IpSec build in General Topics

two Internetconnection IpSec build

Re: two Internetconnection IpSec build