Solved! Go to Solution.
Any reason you aren't using BGP for this? There are ways to influence BGP so you can prefer specific tunnels in a specific order.
I implemented this over a year ago at a former job so I don't remember exactly where the documented steps are. I believe that within the AWS portal, after configuring BGP on the gateway, the exact BGP config will be generated for various models of devices. You just have to select Palo Alto and the specific CLI will be generated, including the necessary IP addresses to use. AWS assigns addresses from the APIPA range for both ends of the tunnel.
As I recall, there really isn't much modification for BGP on the AWS side so everything needs to be done on the PA. On the outbound updates to AWS, I did AS prepend to get the tunnel preference we wanted. For prefixes learned inbound from AWS, I changed the local preference to prefer tunnels in a specific order.
However, If you aren't comfortable with BGP, it might not be the best solution. It works great until it doesn't and you have to troubleshoot at 2am.
Has the asymmetric traffic flow been a problem?
Asymmtric flow was causing issue now due to the PA firewall drop the packet because of the different tunnel returned. It even happenned on ping traffic causes timed out. It was due to PBF & Static Routing metric. By now, BGP will be my last option to solve the issue. I did gone through the document from AWS - https://docs.aws.amazon.com/vpc/latest/adminguide/palo-alto.html and it seems to be straight forward configuration. By the way, since it is on BGP, do we need to involve anyting with ISP?
You can also use OSPF inside IPSec tunnel. Never touch AWS but since OSPF is almost available on any paltform, it should be supported...
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!