- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
02-07-2019 03:22 AM - edited 02-07-2019 03:40 AM
Hi,
We have a PA with two VPNs configured. VPN-Main is the active one and if this vpn falls, the traffic must go through the other VPN-backup. The fact is that when the active VPN falls, the route that has the Palo Alto continues going through the previous VPN, it does not refresh the route and adds it through the new tunnel.
This configuration worked when this deployment was done but suddenly stop working.
We have configured a tunnel monitor with destination IP and profile fail-over.
In VPN Main (active):
In VPN (backup):
And this is the route table:
tunnel.29 is the main (active). The metric is 2.
tunnel.27 is the backup. Metric is 5.
Why PA is not deleting the "active" route if the monitor ip is down through the vpn down.
02-07-2019 09:03 AM
Hello,
Its because they are static routes. For this type of config I would recommend one of the following.
For VPN tunnel A
Use Policy based forwarding with the monitoring and "Disable this rule if nexthop/monitor ip is unreachable" checked.
Then use a static route for tunnel B
The PAN will enforce PBF policies prior to the routing table so when the PBF disables its self the routing table takes affect.
The second option is to use PBF for both tunnels and tunnel B lower on the list. The firewall reads these from top down so it will always prefer tunnel A unless it goes down then switch to tunnel B.
Hope that makes sense.
02-08-2019 01:03 AM
Yes, but its not necesary PBF. It should be work only with tunnel monitoring
https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/vpns/set-up-tunnel-monitoring
Whats the problem with static routes??? static route should dissapear when monitor ip is down.
02-08-2019 01:20 AM
Hi @BigPalo
The static route will be removed from the FIB not the RIB - if you go to the VR and click "More runtime stats" -> "Forwarding Table" it shouldn't be there.
02-08-2019 01:47 AM - edited 02-08-2019 03:25 AM
but the new traffic should use backup tunel, since the static route dissapear for active path.
02-08-2019 07:27 AM
Hello,
In the static route, was the Route monitoring configured? Sorry if I missed it somewhere in the thread?
Regards,
02-08-2019 11:38 AM - edited 02-08-2019 11:39 AM
Hey @OtakarKlier
I may be completely wrong here, but the way that I thought it worked was that if you had tunnel monitoring configured with action of 'fail-over' the actual failover mechanism works by removing any static routes associated with that tunnel interface from the FIB - effectively making it so you can start using another IPSec tunnel via routes in your RIB.
Reading the documentation - when failover option is selected, tunnel interface is disabled so all routes with that tunnel interface are indeed removed from the FIB. So yes @BigPalo this setup is valid and the traffic would start using the backup tunnel so long as your primary tunnel has tunnel monitoring with failover option set.
Cheers,
Luke.
02-11-2019 12:14 AM
PanOS is 7.1.x. It this version there is no path monitoring in the static route.
02-11-2019 12:16 AM
So the version is 7.1.x. We think that its all configured properly but we dont know why its not working
02-11-2019 01:49 PM
A ticket with support may help find the rason why.
02-12-2019 01:37 AM
Hi @BigPalo,
We have similar setup (IPsec failover to secondary tunnel) for two different firewall deployments. Both are on 8.1.x, but the first one was configured back when the FW was still on 7.1.x
I would say that your configuration seems OK - indeed you don't really need policy based routing (I still don't understand why there are instructions for doing such...). As @LukeBullimore mentioned the tunnel monitor will "disable", or bring down the logical tunnel interface, after that is is pure networking - any static routes assosiated with interface in down state will be removed from the FIB - there are still in RIB since they are static, but they are not active so they are not used to forward traffic.
The biggest "gotcha" with tunnel monitor is the encryption domain (proxy-IDs). I learned this through the hard way - If your tunnel is configured with multiple proxy IDs, FW will try to send pings to each of them. But in order for the pings to be successful your source and destination needs to match the proxy ID (interesting traffic needs to match the phase2 SAs)
For example:
ProxyID: local 10.10.10.0/24 - remote 20.20.20.0/24
tunnel.1 IP - 10.10.10.254/32 - tunnel monitor destination 20.20.20.254
The config above will work since you have only one ProxyID which is matching the source and destination addresses of the ping packet.
But if you have:
ProxyID-1: local 10.10.10.0/24 - remote 20.20.20.0/24
ProxyID-2: local 10.10.10.0/24 - remote 30.30.30.0/24
tunnel.1 IP - 10.10.10.254/32 - tunnel monitor destination 20.20.20.254
Here tunnel monitor will report that this tunnel is down. The reason for that is the FW will try to send ping for both proxy-IDs. Pings will success for the first one, but will fail for second proxy ID, because the destination is not matching the remote encrpytion. And all static routes assosiated with this tunnel will be inactive (not installed in the FIB)
So I would suggest to double check if the firewall is still believing that main tunnel is down:
- Under the GUI check tunnel status (the far right icon under IPsec Tunnels)
- Under GUI check statistics for tunnel monitor - show vpn flow name <name if your tunnel >
- If you have multiple proxy-id configured run above command for each proxy-id
02-12-2019 03:21 AM
We dont use proxyIds. Its blank.
02-12-2019 04:08 AM
What is the output of the commad:
> show vpn flow name <name of your tunnel>
Do you see statistics for the monitor? What are they showing?
02-12-2019 05:58 AM
Hi @BigPalo,
This is what i feel, i feel you may face little trouble with this configuration
You have a default route through tunnel and have a tunnel monitoring with fail over in primary and wait-recover in secondary.
and if you dont have a static route to remote peers other that through tunnel,
consider following scenarios
1- primary tunnel-monitor is up - everything works you wont face any issues,
2 - primary tunnel monitor is down - it makes tunnel disable and removes the route, second tunnel will become up and will have a default route through secondary tunnel. as you may not have a static route other than this to remote peer, primary monitoring might be keep on trying to rekey through seconday tunnel which may not be successful. what if your secondary tunnel aldo down now, as you have default monitoring(wait-recover), this tunnel will try to recover and route will be still there.
So i feel you should add a static route to remote peers not through tunnel, and no need of tunnel monitor in secondary as if first one succesfully rekeys, it will add a lower metric route.
02-12-2019 07:15 AM
From the screenshots in the original post you can see his routes through the tunnels are not default routes.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!