topic Re: PBF and ipsec in General Topics

PBF and ipsec

bit_byte — Wed, 06 Jan 2021 17:38:28 GMT

HQ Network and Remote Network location are always through MPLS
PBF is configured with path monitoring for forwarding via MPLS and if mpls fails
traffic will be through ipsec_1 tunnel according to pbf created in palo alto.
How to configure in palo alto if both ipsec1 and mpls down so that traffic should pass through ipsec_2

@jdelio

@Remo

@BPry

Re: PBF and ipsec

reaper — Thu, 07 Jan 2021 13:51:41 GMT

adding another PBF should do the trick (if the first bpf is set to a path monitor profile with fail-over as the action)

Re: PBF and ipsec

bit_byte — Thu, 07 Jan 2021 14:02:41 GMT

@reaper

Create a PBF for MPLS and configure the monitor failover

create a PBF for IPSEC-1 and configure the monitor failover

then create PBF for IPSEC-2. (in this case, if mpls link and IPsec-1 link down then traffic will fail back to ipsec-2 )

Is it right ?

Re: PBF and ipsec

reaper — Fri, 08 Jan 2021 00:28:32 GMT

yes

the pbf rules can be set sequentially and will each perform monitoring to verify if they should be active, as long as 1 is active, 2 will not be hit, when 1's monitor fails 2 takes over and 3 will not be hit, as soon as 2's monitor fails it too will stop functioning and 3 will take over as last resort

lastly you can still resort to a static route