How can I get dual ISP with DUAL IPSEC Tunnel to work with static routes and no tunnel monitor?

[junior_r]

HI,

How can I get dual ISP with DUAL IPSEC Tunnel to work with static routes and no tunnel monitor? I want the IPSEC tunnel to only failover when the primary circuit goes down. Problem I am having is the static route metrics is not taking over when the primary ISP and primary IPSEC tunnel goes down. Metric is 10 for primary tunnel and 20 for backup tunnel.

Thanks

[pulukas]

My recollection is that you really have to use VPN monitor in this scenario because without it the tunnel interface does not go down and therefore your primary route is never removed from the routing table.

[OtakarKlier]

Hello,

I have always looked at the type of site it is, i.e. if its a stub then I used Policy Based Forwarding (but you need a monitor) and a static route for the secondary. That is if primary goes down, the PBF doesnt take affect and so the route takes the static route. You can also possible accomplish this with dynamic routing such as OSPF on both sides and then weigh the routes accordingly, e.g. higher on the secondary, etc.

Hope that points you in the right direction.

Regards,

[Remo]

As @pulukas already mentionned, some kind of monitoring is needed. Without it the primary route will stay in your routing table.
With PAN-OS 8 ther is also a possibility to configure a monitor directly for the static route: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/networking/configure-path-monitoring...