How to configure path monitoring if primary tunnel fail

HussainMohammed — Sat, 04 Sep 2021 12:39:45 GMT

I have created 2 IPSec tunnel and want to configure path monitoring if primary tunnel fail, pls suggest.

Re: How to configure path monitoring if primary tunnel fail

S.Cantwell — Sat, 04 Sep 2021 14:56:02 GMT

You have 3 ways to do this:

Set up a PBF rule, that forces all traffic out of your primary VPN, and you can set up a Path Monitor entry to monitor/ping some IP to determine accessibilty or not. If not accessible, the PBF stops and goes to the routing table.

Set up a tunnel monitoring profile under you IPSec Tunnel. Same concept. Put and IP on your tunnel interface and setup a profile to monitor the accessibility through the tunnel. If inaccessible, fail that tunnel and go to your other way.

Set up a profile for your routing table. You have 2 tunnels, with your primary being set (or should be set) as a more preferred metric.

Setup a path monitor profile for that route. If the connectivity to your primary peer IP fails, then fail the tunnel over to your 2nd VPN route.

https://live.paloaltonetworks.com/t5/general-topics/fail-over-vpn-site-to-site/td-p/249179

topic How to configure path monitoring if primary tunnel fail in General Topics

How to configure path monitoring if primary tunnel fail

Re: How to configure path monitoring if primary tunnel fail