IPsec tunnel Failover between Two PA

Reply
L0 Member

IPsec tunnel Failover between Two PA

I've two Palo Alto firewalls, PA-500 and PA-820.
My PA-500 is having 2 ISPs, so I've configured Tunnel monitoring as Failover on it. I think I've configured everything at right place on PA-500 which have 2 ISPs.
I'm not sure with the configuration at other end at PA-820 as my destination subnet is same, how should I configure same destination to go through single ISP PA to Dual ISP PA for tunnel Failover configuration at other end.
L7 Applicator

Re: IPsec tunnel Failover between Two PA

Hello,

What I do is use OSPF between the two so when the ISP's fail over, and the tunnel changes, the routes are updated. However you could setup a Policy Base Forwarding rule on the 820 and monitor the ISP A interface. I also use /32 addresses with static routes to make sure the systems monitor the proper path.

 

Hope that helps.

L0 Member

Re: IPsec tunnel Failover between Two PA

I want to do the same thing from the sound of your description.  Is there anything special you had to do once you specified you wanted to use failover?  Where in the configuration do you configure the failover to point to the secondary vpn tunnel or does it failover to the secondary automatically since there are only two tunnels configured?

L7 Applicator

Re: IPsec tunnel Failover between Two PA

This can be achived with regular static routes. 

Static routes have monitoring feature also on them.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE (3.0, 5.0, 6.0, 7.0), PCNSE (6, 7), PCNSI
L0 Member

Re: IPsec tunnel Failover between Two PA

@Raido  I have an ip address assigned to the tunnel interface on each side of the vpn tunnel.  Example, tunnel.113 is assigned 1.1.1.1/32 and the other side, tunnel.17 is assigned 1.1.1.2/32.  They're also advertising/receiving routes across the tunnel vial ospf.  Would the static routes take the place of the ip addresses assigned to the ipsec tunnel ends?  I'll read up on the configuration options you mentioned.  Thanks!

L7 Applicator

Re: IPsec tunnel Failover between Two PA

I guess you are not using Cloudflare DNS if you use 1.1.1.1 in firewall config :)

https://1.1.1.1/

 

If you have OSPF configured already then go ahead with that. Not all smaller environments have dynamic routing so static routes could work as well monitoring tunnel failover. That was the reason I mentioned it.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE (3.0, 5.0, 6.0, 7.0), PCNSE (6, 7), PCNSI
L7 Applicator

Re: IPsec tunnel Failover between Two PA

Hello,

Also if you want to make sure all traffic goes down one tunnel rather than both, you can set the second tunnel interface metric to something like 10000. That way the traffic will prefer the first ISP and if there is a failover event, it'll go down the second.

 

Regards,

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!