Creating tunnel monitoring profile between PA-3220 to Meraki SDWAN Cisco

[ChandrashekharD]

Hi Friends,

Our end customer wants to set up tunnel monitoring profile between a PA-3220 firewall and a Cisco Meraki SD-WAN device. Although an IPsec tunnel has already been established between the Palo Alto and the Meraki SD-WAN, we need to determine whether failover will occur automatically if one tunnel goes down, or if tunnel monitoring needs to be configured.

If tunnel monitoring is required, how can we configure a tunnel monitoring profile between the PA-3220 and the Meraki SD-WAN?. Kindly suggest me

Regards,

Chandrashekhar

[TomYoung]

Hi @ChandrashekharD ,

If you have a static route to the IPsec tunnel interface, the VPN will NOT fail over without tunnel monitoring.  With regard to tunnel monitoring, the inside address of the Meraki should work fine.  You want to set the Action in the tunnel monitoring profile to Fail Over.

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-tunnel-monitoring...

Thanks,

Tom