Fail-over VPN site-to-site

[BigPalo]

Hi,

We have a PA with two VPNs configured. VPN-Main is the active one and if this vpn falls, the traffic must go through the other VPN-backup. The fact is that when the active VPN falls, the route that has the Palo Alto continues going through the previous VPN, it does not refresh the route and adds it through the new tunnel.

This configuration worked when this deployment was done but suddenly stop working.

We have configured a tunnel monitor with destination IP and profile fail-over.

In VPN Main (active):

In VPN (backup):

And this is the route table:

tunnel.29 is the main (active). The metric is 2.

tunnel.27 is the backup. Metric is 5.

Why PA is not deleting the "active" route if the monitor ip is down through the vpn down.

[OtakarKlier]

Hello,

Its because they are static routes. For this type of config I would recommend one of the following.

For VPN tunnel A

Use Policy based forwarding with the monitoring and "Disable this rule if nexthop/monitor ip is unreachable" checked.

Then use a static route for tunnel B

The PAN will enforce PBF policies prior to the routing table so when the PBF disables its self the routing table takes affect.

The second option is to use PBF for both tunnels and tunnel B lower on the list. The firewall reads these from top down so it will always prefer tunnel A unless it goes down then switch to tunnel B.

Hope that makes sense.

[BigPalo]

Yes, but its not necesary PBF. It should be work only with tunnel monitoring

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/vpns/set-up-tunnel-monitoring

Whats the problem with static routes???  static route should dissapear when monitor ip is down.

[LukeBullimore]

Hi @BigPalo

The static route will be removed from the FIB not the RIB - if you go to the VR and click "More runtime stats" -> "Forwarding Table" it shouldn't be there.

[BigPalo]

but the new traffic should use backup tunel, since the static route dissapear for active path.

[OtakarKlier]

Hello,

In the static route, was the Route monitoring configured? Sorry if I missed it somewhere in the thread?

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-new-features/networking-features/static-route-re...

Regards,

[LukeBullimore]

Hey @OtakarKlier

I may be completely wrong here, but the way that I thought it worked was that if you had tunnel monitoring configured with action of 'fail-over' the actual failover mechanism works by removing any static routes associated with that tunnel interface from the FIB - effectively making it so you can start using another IPSec tunnel via routes in your RIB.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/vpns/set-up-site-to-site-vpn/set-up-tunnel...

Reading the documentation - when failover option is selected, tunnel interface is disabled so all routes with that tunnel interface are indeed removed from the FIB. So yes @BigPalo this setup is valid and the traffic would start using the backup tunnel so long as your primary tunnel has tunnel monitoring with failover option set.

Cheers,

Luke.

[BigPalo]

PanOS is 7.1.x. It this version there is no path monitoring in the static route.

[BigPalo]

So the version is 7.1.x. We think that its all configured properly but we dont know why its not working

[OtakarKlier]

A ticket with support may help find the rason why.

[aleksandar.astardzhiev]

Hi @BigPalo,

We have similar setup (IPsec failover to secondary tunnel) for two different firewall deployments. Both are on 8.1.x, but the first one was configured back when the FW was still on 7.1.x

I would say that your configuration seems OK - indeed you don't really need policy based routing (I still don't understand why there are instructions for doing such...). As @LukeBullimore mentioned the tunnel monitor will "disable", or bring down the logical tunnel interface, after that is is pure networking - any static routes assosiated with interface in down state will be removed from the FIB - there are still in RIB since they are static, but they are not active so they are not used to forward traffic.

The biggest "gotcha" with tunnel monitor is the encryption domain (proxy-IDs). I learned this through the hard way - If your tunnel is configured with multiple proxy IDs, FW will try to send pings to each of them. But in order for the pings to be successful your source and destination needs to match the proxy ID (interesting traffic needs to match the phase2 SAs)

For example:

ProxyID: local 10.10.10.0/24 - remote 20.20.20.0/24
tunnel.1 IP - 10.10.10.254/32 - tunnel monitor destination 20.20.20.254

The config above will work since you have only one ProxyID which is matching the source and destination addresses of the ping packet.

But if you have:

ProxyID-1: local 10.10.10.0/24 - remote 20.20.20.0/24

ProxyID-2: local 10.10.10.0/24 - remote 30.30.30.0/24
tunnel.1 IP - 10.10.10.254/32 - tunnel monitor destination 20.20.20.254

Here tunnel monitor will report that this tunnel is down. The reason for that is the FW will try to send ping for both proxy-IDs. Pings will success for the first one, but will fail for second proxy ID, because the destination is not matching the remote encrpytion. And all static routes assosiated with this tunnel will be inactive (not installed in the FIB)

So I would suggest to double check if the firewall is still believing that main tunnel is down:

- Under the GUI check tunnel status (the far right icon under IPsec Tunnels)

- Under GUI check statistics for tunnel monitor - show vpn flow name <name if your tunnel >

- If you have multiple proxy-id configured run above command for each proxy-id

[BigPalo]

We dont use proxyIds. Its blank.

[aleksandar.astardzhiev]

What is the output of the commad:

> show vpn flow name <name of your tunnel>

Do you see statistics for the monitor? What are they showing?

[Abdul_Razaq]

Hi @BigPalo,

This is what i feel, i feel you may face little trouble with this configuration

You have a default route through tunnel and have a tunnel monitoring with fail over in primary and wait-recover in secondary.

and if you dont have a static route to remote peers other that through tunnel,

consider following scenarios

1- primary tunnel-monitor  is up - everything works you wont face any issues,

2 - primary tunnel monitor is down - it makes tunnel disable and removes the route, second tunnel will become up and will have a default route through secondary tunnel. as you may not have a static route other than this to remote peer, primary monitoring might be keep on trying to rekey through seconday tunnel which may not be successful. what if your secondary tunnel aldo down now, as you have default monitoring(wait-recover), this tunnel will try to recover and route will be still there.

So i feel you should add a static route to remote peers not through tunnel, and no need of tunnel monitor in secondary as if first one succesfully rekeys, it will add a lower metric route.

[aleksandar.astardzhiev]

@Abdul_Razaq,

From the screenshots in the original post you can see his routes through the tunnels are not default routes.