Configuring Dual Leased Lines on PA-220 for Efficient Failover

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Configuring Dual Leased Lines on PA-220 for Efficient Failover

L0 Member

 

Hello,

We've set up a dual leased line configuration with BT, featuring two separate gateways. Our primary aim is to ensure continuous connectivity, should one of the lines fail.

Our PA 220's static routing has been configured as follows:

- For BT1, we've assigned Ethernet interface 4 with a default route (0.0.0.0/0) having an administrative distance of 10 and a metric of 10, pointing to its specific gateway.
- For BT2, Ethernet interface 5 is set up similarly, with a default route but an administrative distance of 20 and a metric of 20, also pointing to its designated gateway.

Path monitoring has been enabled for both lines.

Both interfaces are in the same zone, with ECMP activated to support symmetric return traffic, utilizing the IP modulo method for traffic distribution.

We've achieved theoretical line redundancy; either line can take over if the other fails. However, we encounter an issue with NAT policy prioritization. The system only routes traffic correctly if the NAT policy for the active line is listed first. If we disconnect one line and the NAT policy for the disconnected line appears at the top, the system fails to bypass it for the active line's NAT policy.

Our setup is on PAN-OS 11.

What adjustments are necessary to ensure seamless failover between the two lines without manual NAT policy reordering?

EDIT:

some progress, interfaces selection indeed solved that issue, but now similar one with the two tunnels (one for each line) to azure where our Domain controller with DNS is. Only the line with the top priority tunnel will work, is it possible to ignore the tunnel which is disconnected? I was planning to use path monitoring but in the source drop down, I can only select PPPoE or DHCP while I have a static address.

 

3 REPLIES 3

Cyber Elite
Cyber Elite

Hello @paul.faisant ,

 

As you've mentioned that both lease line interfaces are in same zone, can you confirm the NAT configuration?

Can you check if you've configured the destination interface in NAT policy? If you haven't configured, please configure destination interfaces in the respective NAT policies and then check.

 

 

M

Cyber Elite
Cyber Elite

I concur with @SutareMayur , your NAT rules need to be configured with a destination interface for this to work properly

 

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L0 Member

EDIT:

some progress, interfaces selection indeed solved that issue, but now similar one with the two tunnels (one for each line) to azure where our Domain controller with DNS is. Only the line with the top priority tunnel will work, is it possible to ignore the tunnel which is disconnected? I was planning to use path monitoring but in the source drop down, I can only select PPPoE or DHCP while I have a static address.

  • 266 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!