Fail-over VPN site-to-site

Showing results for 
Search instead for 
Did you mean: 

Fail-over VPN site-to-site

L4 Transporter



We have a PA with two VPNs configured. VPN-Main is the active one and if this vpn falls, the traffic must go through the other VPN-backup. The fact is that when the active VPN falls, the route that has the Palo Alto continues going through the previous VPN, it does not refresh the route and adds it through the new tunnel.

This configuration worked when this deployment was done but suddenly stop working.


We have configured a tunnel monitor with destination IP and profile fail-over.


In VPN Main (active):




In VPN (backup):




And this is the route table:




tunnel.29 is the main (active). The metric is 2.

tunnel.27 is the backup. Metric is 5.


Why PA is not deleting the "active" route if the monitor ip is down through the vpn down.





Hi @BigPalo,


We have similar setup (IPsec failover to secondary tunnel) for two different firewall deployments. Both are on 8.1.x, but the first one was configured back when the FW was still on 7.1.x


I would say that your configuration seems OK - indeed you don't really need policy based routing (I still don't understand why there are instructions for doing such...). As @LukeBullimore mentioned the tunnel monitor will "disable", or bring down the logical tunnel interface, after that is is pure networking - any static routes assosiated with interface in down state will be removed from the FIB - there are still in RIB since they are static, but they are not active so they are not used to forward traffic.


The biggest "gotcha" with tunnel monitor is the encryption domain (proxy-IDs). I learned this through the hard way - If your tunnel is configured with multiple proxy IDs, FW will try to send pings to each of them. But in order for the pings to be successful your source and destination needs to match the proxy ID (interesting traffic needs to match the phase2 SAs)


For example:

ProxyID: local - remote
tunnel.1 IP - - tunnel monitor destination

The config above will work since you have only one ProxyID which is matching the source and destination addresses of the ping packet.


But if you have:

ProxyID-1: local - remote

ProxyID-2: local - remote
tunnel.1 IP - - tunnel monitor destination


Here tunnel monitor will report that this tunnel is down. The reason for that is the FW will try to send ping for both proxy-IDs. Pings will success for the first one, but will fail for second proxy ID, because the destination is not matching the remote encrpytion. And all static routes assosiated with this tunnel will be inactive (not installed in the FIB)


So I would suggest to double check if the firewall is still believing that main tunnel is down:

- Under the GUI check tunnel status (the far right icon under IPsec Tunnels)

- Under GUI check statistics for tunnel monitor - show vpn flow name <name if your tunnel >

- If you have multiple proxy-id configured run above command for each proxy-id



We dont use proxyIds. Its blank.

What is the output of the commad:


> show vpn flow name <name of your tunnel>


Do you see statistics for the monitor? What are they showing?

L4 Transporter

Hi @BigPalo,


This is what i feel, i feel you may face little trouble with this configuration

You have a default route through tunnel and have a tunnel monitoring with fail over in primary and wait-recover in secondary.

and if you dont have a static route to remote peers other that through tunnel,

consider following scenarios

1- primary tunnel-monitor  is up - everything works you wont face any issues,

2 - primary tunnel monitor is down - it makes tunnel disable and removes the route, second tunnel will become up and will have a default route through secondary tunnel. as you may not have a static route other than this to remote peer, primary monitoring might be keep on trying to rekey through seconday tunnel which may not be successful. what if your secondary tunnel aldo down now, as you have default monitoring(wait-recover), this tunnel will try to recover and route will be still there.


So i feel you should add a static route to remote peers not through tunnel, and no need of tunnel monitor in secondary as if first one succesfully rekeys, it will add a lower metric route.




From the screenshots in the original post you can see his routes through the tunnels are not default routes.



Hi @Astardzhiev 


We have the same problem with failover VPN. We have 6 proxy IDs in the tunnel and the primary ipsec tunnel drops. You explained why it drops and now I am interested if you have maybe any solution for that problem?



Hi @LukaPecher,


My solution was to split the proxy-id into separate IPsec tunnel configuration. It may sound very confusing, so I will try to explain it as clear as possible:

- You will need four ipsec tunnel - two tunnel to primary remote peer and two tunnel to secondary remote peer

- First two tunnels must be assigned with same tunnel interface (let say tunnel.1) and same IKE gateway (remote peer)

- Second two tunnels also must be assigned to same tunnel interface - tunnel.2 and same remote peer


- First primary tunnel will be configure with tunnel monitor enabled and with only one proxy-id that match the source and dest of the monitor

- Second primary tunnel will be configured with tunnel monitor disabled and with as many proxy-id as you like/need, excluding the proxy-id configured in the first primary


Identical you need to configure the second two tunnels to the secondary remote peer.


So under Network > IPsec Tunnels you should have something like that:



That way the tunnel monitor will send pings only via the correct proxy-id.

If the pings fail (for what ever reason), tunnel monitor will bring the logical tunnel interface. And because we are using the same tunnel interface for the second tunnel (to the primary peer without monitor), all the routes to tunnel.1 will be remove from FIB and traffic wil be redirected to secondary tunnel.



How would pbf work with VPN.  I thought VPN traffic you could use pbf?


Thank you


Yes PBF can work. You would set the static route to the secondary tunnel and the PBF would point at the primary VPN with a tunnel monitor and disable of the policy.


The PBF takes effect prior to the Virtual Router, so if the PBF is disabled because of primary VPN down and tunnel monitor, the Virtual router then uses the static route that points at the secondary VPN tunnel.


Hope this helps.

Ok in my situation I have 1 VPN tunnel as backup and the primary fiber circuit lives on our core switchs.  The VPN tunnel points to the VIP on our cores until I manually change routes on the Palo to move to vpn when fiber circuit failure occur.  The other side isn't owned by us and don't support BFD.  I have a flow direct set on cores to remove the primary route (when unavailable) and send the traffic to the FW to engage the VPN but the FW routes are static and trying to decide to use PBF if possible to switch the traffic.  The VIPs on cores won't ever go down and looked at tunnel monitoring and path monitoring too but not sure how well it would work with only one VPN tunnel and the primary route to the core VIP.  All thoughts are welcome.  Thank you

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!