09-04-2021 05:39 AM
I have created 2 IPSec tunnel and want to configure path monitoring if primary tunnel fail, pls suggest.
09-04-2021 07:56 AM
You have 3 ways to do this:
Set up a PBF rule, that forces all traffic out of your primary VPN, and you can set up a Path Monitor entry to monitor/ping some IP to determine accessibilty or not. If not accessible, the PBF stops and goes to the routing table.
Set up a tunnel monitoring profile under you IPSec Tunnel. Same concept. Put and IP on your tunnel interface and setup a profile to monitor the accessibility through the tunnel. If inaccessible, fail that tunnel and go to your other way.
Set up a profile for your routing table. You have 2 tunnels, with your primary being set (or should be set) as a more preferred metric.
Setup a path monitor profile for that route. If the connectivity to your primary peer IP fails, then fail the tunnel over to your 2nd VPN route.
https://live.paloaltonetworks.com/t5/general-topics/fail-over-vpn-site-to-site/td-p/249179
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
