IPsec tunnel Failover between Two PA

[Pune_IT]

I've two Palo Alto firewalls, PA-500 and PA-820.
My PA-500 is having 2 ISPs, so I've configured Tunnel monitoring as Failover on it. I think I've configured everything at right place on PA-500 which have 2 ISPs.
I'm not sure with the configuration at other end at PA-820 as my destination subnet is same, how should I configure same destination to go through single ISP PA to Dual ISP PA for tunnel Failover configuration at other end.

[OtakarKlier]

Hello,

What I do is use OSPF between the two so when the ISP's fail over, and the tunnel changes, the routes are updated. However you could setup a Policy Base Forwarding rule on the 820 and monitor the ISP A interface. I also use /32 addresses with static routes to make sure the systems monitor the proper path.

Hope that helps.

[itwebadmin]

I want to do the same thing from the sound of your description.  Is there anything special you had to do once you specified you wanted to use failover?  Where in the configuration do you configure the failover to point to the secondary vpn tunnel or does it failover to the secondary automatically since there are only two tunnels configured?

[Raido_Rattameister]

This can be achived with regular static routes. 

Static routes have monitoring feature also on them.

[itwebadmin]

@Raido_Rattameister  I have an ip address assigned to the tunnel interface on each side of the vpn tunnel.  Example, tunnel.113 is assigned 1.1.1.1/32 and the other side, tunnel.17 is assigned 1.1.1.2/32.  They're also advertising/receiving routes across the tunnel vial ospf.  Would the static routes take the place of the ip addresses assigned to the ipsec tunnel ends?  I'll read up on the configuration options you mentioned.  Thanks!

[Raido_Rattameister]

I guess you are not using Cloudflare DNS if you use 1.1.1.1 in firewall config 🙂

https://1.1.1.1/

If you have OSPF configured already then go ahead with that. Not all smaller environments have dynamic routing so static routes could work as well monitoring tunnel failover. That was the reason I mentioned it.

[OtakarKlier]

Hello,

Also if you want to make sure all traffic goes down one tunnel rather than both, you can set the second tunnel interface metric to something like 10000. That way the traffic will prefer the first ISP and if there is a failover event, it'll go down the second.

Regards,