Dual ISP Failover with site to site VPNs

[Evahi21]

Hey everyone,

Just started with Palo and was researching the optimal way of configuring ISP failover to include automatic failover of site to site tunnels.

Is there a reason to use PBF over static route removal?

Based on the reading date I was doing today, SRR appears less convoluted than PBF and seems the most similar to Cisco's SLA configuration which worked well for me before.

omegle

Thanks

[OtakarKlier]

Hello,

I have done this many times. First I setup VPN connections via both ISP's. Then I create OSPF adjacencies between the two VPN endpoints. I then use metrics so that I force the traffic down the VPN tunnel I choose as primary and secondary. So for the secondary i would choose a metric such as 5000, this makes sure the primary tunnel is the preferred one.

I have also used Policy based forwarding to accomplish the same thing. IT all depends on which one you are most comfortable with.

Regards,

[TomYoung]

Hi @Evahi21 ,

If you have at least 1 public IP address advertised to both ISPs, I would use a loopback for a single VPN tunnel.  That design is by far the simplest, but requires a separate public subnet than the ones on the interfaces.

Thanks,

Tom

[PAdekeye]

Hi,

I am having similar issue, but I need more guidelines. I have two ISPs and I want each of them to be used for primary and secondary between Palo Alto and Cisco ASA. From the ASA side, I kept have issue each time I try to bring up the two tunnel at the same time. So far I can only have one tunnel up and when the primary is down, I have to delete the tunnel for it on the ASA side and have only the secondary tunnel used at a time.

Is there are a way to configure this correctly?

Please advise from your experience.

[OtakarKlier]

Hello,

So you want one tunnel one each ISP? This should be possible as long as the public IP's you are using on the PA are different. I recall Cisco having troubles when you try to connect two Tunnels to the same device on the other side but could be remembering this incorrectly.