Dual ISP Failover with site to site VPNs

[Evahi21]

Hey everyone,

Just started with Palo and was researching the optimal way of configuring ISP failover to include automatic failover of site to site tunnels.

Is there a reason to use PBF over static route removal?

Based on the reading date I was doing today, SRR appears less convoluted than PBF and seems the most similar to Cisco's SLA configuration which worked well for me before.

omegle

Thanks

[OtakarKlier]

Hello,

I have done this many times. First I setup VPN connections via both ISP's. Then I create OSPF adjacencies between the two VPN endpoints. I then use metrics so that I force the traffic down the VPN tunnel I choose as primary and secondary. So for the secondary i would choose a metric such as 5000, this makes sure the primary tunnel is the preferred one.

I have also used Policy based forwarding to accomplish the same thing. IT all depends on which one you are most comfortable with.

Regards,

[TomYoung]

Hi @Evahi21 ,

If you have at least 1 public IP address advertised to both ISPs, I would use a loopback for a single VPN tunnel.  That design is by far the simplest, but requires a separate public subnet than the ones on the interfaces.

Thanks,

Tom