09-13-2023 08:08 AM
Is there a way to setup TWO IPsec tunnels using different paths (for instance, two different ISP's) and have them share the traffic load between the two vs having a primary and backup?
I'm aware we can setup two tunnels and use path monitoring to fail over from one tunnel to the other but is there a way to have two or more tunnels and have the traffic load balanced and still function should one path go down?
Right now I'm anticipating we'll need a number of additional routes added to our route table for a backup path with duplicate routes but different metrics between tunnel.1 and tunnel.2 but I'd rather have address X be the next hop and then X forwards to tunnel.1 or tunnel.2 to utilize both paths so one isn't sitting idle.
Bottom line is we just want to utilize all the bandwidth we have available but maintain some failover capability should a path drop.
FYI this would be for PAN-OS 10.2.
09-13-2023 08:15 AM
Hi there,
Assuming identical prefixes are being made available by both tunnels, then enabling ECMP within the Virtual Router will load balance traffic between equal costs paths.
Keep in mind that this is per flow load balancing, so you will never get a 50/50 split in bandwidth utilization.
cheers,
Seb.
09-13-2023 08:15 AM
Hi there,
Assuming identical prefixes are being made available by both tunnels, then enabling ECMP within the Virtual Router will load balance traffic between equal costs paths.
Keep in mind that this is per flow load balancing, so you will never get a 50/50 split in bandwidth utilization.
cheers,
Seb.
09-13-2023 09:21 AM
I'm probably being stupid so I apologize but what is meant by "prefixes"? You mean the subnet prefixes such as /16, /24, etc?
09-13-2023 10:32 AM
Hi there,
In this context the network prefix referees to the subnet ID and netmask, ie 10.0.0.0/8.
Once you have enabled ECMP, and are advertising prefixes by say BGP, you will want to have two entries for each prefix in the BGP RIB, both with the same attributes and therfore same metric. Both will then appear in the routing table and the palo will load balance flows across the two tunnels.
Cheers,
Seb.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
