IPsec tunnel Failover between Two PA

Showing results for 
Show  only  | Search instead for 
Did you mean: 

IPsec tunnel Failover between Two PA

L0 Member
I've two Palo Alto firewalls, PA-500 and PA-820.
My PA-500 is having 2 ISPs, so I've configured Tunnel monitoring as Failover on it. I think I've configured everything at right place on PA-500 which have 2 ISPs.
I'm not sure with the configuration at other end at PA-820 as my destination subnet is same, how should I configure same destination to go through single ISP PA to Dual ISP PA for tunnel Failover configuration at other end.

Cyber Elite
Cyber Elite


What I do is use OSPF between the two so when the ISP's fail over, and the tunnel changes, the routes are updated. However you could setup a Policy Base Forwarding rule on the 820 and monitor the ISP A interface. I also use /32 addresses with static routes to make sure the systems monitor the proper path.


Hope that helps.

I want to do the same thing from the sound of your description.  Is there anything special you had to do once you specified you wanted to use failover?  Where in the configuration do you configure the failover to point to the secondary vpn tunnel or does it failover to the secondary automatically since there are only two tunnels configured?

This can be achived with regular static routes. 

Static routes have monitoring feature also on them.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

@Raido_Rattameister  I have an ip address assigned to the tunnel interface on each side of the vpn tunnel.  Example, tunnel.113 is assigned and the other side, tunnel.17 is assigned  They're also advertising/receiving routes across the tunnel vial ospf.  Would the static routes take the place of the ip addresses assigned to the ipsec tunnel ends?  I'll read up on the configuration options you mentioned.  Thanks!

I guess you are not using Cloudflare DNS if you use in firewall config 🙂


If you have OSPF configured already then go ahead with that. Not all smaller environments have dynamic routing so static routes could work as well monitoring tunnel failover. That was the reason I mentioned it.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011


Also if you want to make sure all traffic goes down one tunnel rather than both, you can set the second tunnel interface metric to something like 10000. That way the traffic will prefer the first ISP and if there is a failover event, it'll go down the second.



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!