ISP Failover With Controlled Failback

[AllanRaskin]

We have a pair of PA-3020 setup with HA and ISP Failover. PAN OS 9.1.3-h. I am not using PBF. I want to connect our VOIP phone switch to the firewall. Our VOIP phones connect to a cloud based PBX. I setup a new VR for VOIP with ports for ISP1, ISP2, and Inside. Failover / Failback works fine. Here is the problem. ISP1 goes Offline and the telephone call drops. Twenty seconds later the firewalls Failover and the dial tone comes back. You now call back the person you where disconnected from. While on the phone with them for the second time, ISP1 comes back online and the phone call drops again while the firewalls Failback to ISP1. This is a standard Metric based IPS Failover configuration. If ISP1 goes offline, I want my VOIP VR to stay active on ISP2 until such time that ISP2 goes offline and only then Failback to ISP1. We have separate VRs for Production, Guest, and now VOIP. NAT and Policies are setup and working properly. Any suggestions would be greatly appreciated. Thanks 

[BPry]

@AllanRaskin,

That's not really a thing with static route monitoring. You could set an artificially high preemptive hold timer which would prevent that failover until the link has been stable. This is slightly limited, but since it can be up to 1,440 minutes that really shouldn't be that much of an issue. 

[AllanRaskin]

Thank you for taking the time to respond. One thought, what if I add a second Path Monitoring Destination under Secondary-ISP-Route using Source: Outside-Secondary / Destination 8.8.8.8 and then change Failure Condition to "All"? Right now I have only one Condition, Source: Outside-Secondary / Destination: ISP2-Gateway. When both pipes are online does the Metric simply override Conditions? Thanks again.

[OtakarKlier]

Hello,

Disable preemptive failback.

This way the secodnary firewall will be running until you manually fail it back to the primary.

Regards,