How to route internet traffic through a tunnel interface

[helge]

What's the best way to route all internet traffic (except IPSec VPN tunnels) through a IPSec VPN tunnel interface?

We want to have a single point where all internet traffic passes through and uses the same policies for web and applications.

[rmonvon]

Hi...You can try defining a default route and set the next-hop to be the tunnel interface.  Thanks.

[helge]

Hi,

I've already tried to set the default route (0.0.0.0) to the tunnel interface, and set the next hop to the gateway for the tunnel interface. But it seems like this configuration is not working with the logic/processing flowchart of the firewall.

On the remote PA firewall I've added a rule from the VPN zone to Untrust and NAT rule.

Another possible solution is to add static routes to the remote IP of the firewall with a next hop to the gateway, and then route default gateway through the tunnel. I haven't had chance to try this out as this is in a production environment. Anyone have a lab setup they could test this? Or even better, anyone else actually routing default gateway through a tunnel interface?

[licenselu]

Hello,

In your previous mail, you said :

Another possible solution is to add static routes to the remote IP of the firewall with a next hop to the gateway, and then route default gateway through the tunnel.

Basically, that's the only way to solve your issue !

With this config, it should work...

Regards,

Hedi

[rmonvon]

Hi...You configured 2 things here: 'set the default route (0.0.0.0) to the tunnel interface, and set the next hop to the gateway for the tunnel interface.'  I would recommend testing only one: set the default route 0.0.0.0/0 to the tunnel interface and leave the next hop at <none>.  Thanks.

[hsnetworks01]

Hi. Not work for PPoE with static address (other in default). Any idea? Thanks.