two Internetconnection IpSec build

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

two Internetconnection IpSec build

L3 Networker

Hello, I have two PAs and want to build IPSec tunnels between them. one PA A has a static IP. The other PA B has two internet connections. One with a static IP and one with a dynamic IP. Now I want to build two tunnels from device B to the A side. my two internet interfaces eth 1/4 has the IP 192.189.5.4 and the router behind it has the IP 192.168.5.1. What should my routing look like? Both interfaces are in the same default VR. There I have a route 0.0.0.0/0 on interface eth 1/1 where my main internet connection is. My other side where the tunnel should terminate is the 1.1.1.1 IP.
Don't really know right now.When my tunnel from eth 1/4 now start, it will go to the untrust zone of eth 1/1.

 

Where can I find helpful information?

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hello,

As for the VPN, here is the article you would want to read:

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0

 

As for routing, you have several choices:

 

OSPF with one VPN path having a higher cost of say 10000

Static with route monitoring, .e.g the route will be removed if the far end IP is not reached

Policy based forwarding with monitoring, e.g. the PBF rule will not take affect is the far end IP is not reached.

 

The way I have done it in the past is assign IP to the Tunnel interfaces, like /30's and then make the far side /32 routing using static routing. So if the tunnel is down the IP is never reachable since its static routing and the other protocols are of lower value.

 

Hope this makes sense. Let me know if you would like clarification.

 

Cheers!

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

Hello,

As for the VPN, here is the article you would want to read:

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0

 

As for routing, you have several choices:

 

OSPF with one VPN path having a higher cost of say 10000

Static with route monitoring, .e.g the route will be removed if the far end IP is not reached

Policy based forwarding with monitoring, e.g. the PBF rule will not take affect is the far end IP is not reached.

 

The way I have done it in the past is assign IP to the Tunnel interfaces, like /30's and then make the far side /32 routing using static routing. So if the tunnel is down the IP is never reachable since its static routing and the other protocols are of lower value.

 

Hope this makes sense. Let me know if you would like clarification.

 

Cheers!

  • 1 accepted solution
  • 2163 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!