Dual/HA IPsec tunnels with 2 ISPs ?

[essnet]

Hello,

I have 2 PaloAltos, one is running on robust and redundant Corp internet ISP, another one on a remote location with 2 public  ADSL (and miserable quality ofc !). My goal is to have a redundant IPsec link between the two PaloAltos :

How would you achieve this ? I have several scenarios in mind:

• PA2 builds 2 tunnels (one from each ISP) all time and routing is done with BGP (or any other routing protocol), so if a link fails, that routing protocol will timeout and route will vanish from each PA, so traffic will fail to the remaining one.
• PA2 builds 1 tunnel at a time : a PBF will detect if ISP1 is dead and failover traffic to ISP2. This solution may not work as my lowcost ISPs don't have same public adress, so it would mean that PA2 needs to reset old tunnel before creating new one (does it even support this automatically?). What would be the timeframe of such failover also ?

thank you in advance for your suggestions, feedback and questions !

Regards,

[rmonvon]

Hi...I believe both scenarios will work.  The 1st scenario is using dynamic routing and one path will be selected over the other.  This requires only dynamic routing to be enabled.

The 2nd method require some static routing and PBF.  You can configure PBF to disable the forwarding rule should the next hop is down, and traffic will take the 2nd path.  The failover time is configurable when you set the monitoring of the next-hop, so you can adjust this to fit your enviroment.

Thanks.