How to configure path monitoring if primary tunnel fail

cancel
Showing results for 
Search instead for 
Did you mean: 

How to configure path monitoring if primary tunnel fail

L1 Bithead

I have created 2 IPSec tunnel and want to configure path monitoring if primary tunnel fail, pls suggest.

1 REPLY 1

Cyber Elite
Cyber Elite

You have 3 ways to do this:

 

Set up a PBF rule, that forces all traffic out of your primary VPN, and you can set up a Path Monitor entry to monitor/ping some IP to determine accessibilty or not.  If not accessible, the PBF stops and goes to the routing table.

 

Set up a tunnel monitoring profile under you IPSec Tunnel. Same concept.  Put and IP on your tunnel interface and setup a profile to monitor the accessibility through the tunnel. If inaccessible, fail that tunnel and go to your other way.

 

Set up a profile for your routing table.  You have 2 tunnels, with your primary being set (or should be set) as a more preferred metric.

Setup a path monitor profile for that route.  If the connectivity to your primary peer IP fails, then fail the tunnel over to your 2nd VPN route.

 

https://live.paloaltonetworks.com/t5/general-topics/fail-over-vpn-site-to-site/td-p/249179

 

Help the community: Like helpful comments and mark solutions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!