Multiple tunnel to single destination over multiple WAN connections.

[gondolf]

Hi, 

I am new to Palo Alto and require some help with design and configuration. 

Site A Palo Alto -- 

ISP A - P2P link

ISP B - P2P link

ISP C - MPLS link 

Azure Gateway 

I have to configure the tunnel from each of the ISP to the Azure and make sure each tunnel take precedence as it listed. 

What I understand,

I can do the static route over tunnel and priroties each of them with Metric.. ( Higher the metric lower the perference)

I also understand I can setup Path Monitoring on Primary tunnel for failover .. and do the same on secondary tunnel so if both fails the route removes and the third tunnel take over. 

I have a question though.

what are the chances to have the tunnel source as loop back ? ( interface advertised via ISP between site and Azure over private link)

setup the BGP between tunnel source and Azure gateway address?

As long as tunnel source and azure gateway is rechable tunnel stays up. 

This way I can only create one tunnel. ( something like SDWAN, it is not relies on the WAN services)

Or only option I have is SDWAN?

Thank you.

[OtakarKlier · Accepted solution]

Hello,

I can answer a few of these and provide some personal insights:

• what are the chances to have the tunnel source as loop back ? ( interface advertised via ISP between site and Azure over private link)
  • I believe that you have to use a physical interface, not sure if this has changed.
• setup the BGP between tunnel source and Azure gateway address?
  • I wouldnt since its over complicated
    • I tend to use either Policy Based forwarding with symmetric return or like you mentioned static metrics.
• As long as tunnel source and azure gateway is rechable tunnel stays up. 
  • correct, both tunnels would be up and you would decide on the monitoring and flow of the traffic.

When I did this to a cloud provider, I just built the two tunnels and used Policy Based Forwarding.

Resource list for VPN's.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clh5CAC

Hope this helps.