Conditional Advertisement / BGP Failover with Dual ISP — How to Remove ISP1 Routes on Internet Loss?

[Austin_Mascarenhas]

Hi all,

I’m running a dual-ISP setup on a PA  with BGP to ISP1 and ISP2. My goal is:

1. Monitor ISP1 default route / Internet reachability.

2. If ISP1 becomes unusable, I want all traffic to fail over to ISP2.

3. I am advertising an IP pool to both ISP1 and ISP2 for incoming traffic, with AS-path prepending applied to ISP2 so that incoming traffic prefers ISP1. Ideally, I would like all ISP1 routes to be withdrawn when the upstream Internet fails.

Here’s what I’ve tried and observed:

• Conditional Advertisement:
  I configured a policy on ISP2 to advertise the IP pool only when ISP1 default is missing. Works in principle, but I cannot cancel advertisement to ISP1 just because ISP1 stops sending a default route.

• Path Monitoring (pinging a remote IP):
  This removes the route for outbound traffic, so outgoing connections failover to ISP2. However, the IP pool advertisement is still sent to ISP1, so incoming traffic continues to fail.

Questions:

1. Is there any way in PAN-OS to completely withdraw all BGP routes and bring down ISP1 session when the Internet behind ISP1 fails but the peer IP is still reachable?

2. Would combining conditional advertisement / AS-path prepending achieve practical failover for both incoming and outgoing traffic?

3. Are there any recommended workarounds in PA for this scenario that don’t involve extra hardware or ISP cooperation?

Appreciate any guidance or shared experiences.