Multiple tunnel to single destination over multiple WAN connections.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Multiple tunnel to single destination over multiple WAN connections.

L1 Bithead

Hi, 

 

I am new to Palo Alto and require some help with design and configuration. 

 

Site A Palo Alto -- 

 

ISP A - P2P link

ISP B - P2P link

ISP C - MPLS link 

 

Azure Gateway 

 

I have to configure the tunnel from each of the ISP to the Azure and make sure each tunnel take precedence as it listed. 

 

What I understand,

 

I can do the static route over tunnel and priroties each of them with Metric.. ( Higher the metric lower the perference)

 

I also understand I can setup Path Monitoring on Primary tunnel for failover .. and do the same on secondary tunnel so if both fails the route removes and the third tunnel take over. 

 

I have a question though.

 

what are the chances to have the tunnel source as loop back ? ( interface advertised via ISP between site and Azure over private link)

 

setup the BGP between tunnel source and Azure gateway address?

 

As long as tunnel source and azure gateway is rechable tunnel stays up. 

 

This way I can only create one tunnel. ( something like SDWAN, it is not relies on the WAN services)

 

Or only option I have is SDWAN?

 

Thank you.

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hello,

I can answer a few of these and provide some personal insights:

  • what are the chances to have the tunnel source as loop back ? ( interface advertised via ISP between site and Azure over private link)
    • I believe that you have to use a physical interface, not sure if this has changed.
  • setup the BGP between tunnel source and Azure gateway address?
    • I wouldnt since its over complicated
      • I tend to use either Policy Based forwarding with symmetric return or like you mentioned static metrics.
  • As long as tunnel source and azure gateway is rechable tunnel stays up. 
    • correct, both tunnels would be up and you would decide on the monitoring and flow of the traffic.

When I did this to a cloud provider, I just built the two tunnels and used Policy Based Forwarding.

Resource list for VPN's.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clh5CAC

 

Hope this helps.

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

Hello,

I can answer a few of these and provide some personal insights:

  • what are the chances to have the tunnel source as loop back ? ( interface advertised via ISP between site and Azure over private link)
    • I believe that you have to use a physical interface, not sure if this has changed.
  • setup the BGP between tunnel source and Azure gateway address?
    • I wouldnt since its over complicated
      • I tend to use either Policy Based forwarding with symmetric return or like you mentioned static metrics.
  • As long as tunnel source and azure gateway is rechable tunnel stays up. 
    • correct, both tunnels would be up and you would decide on the monitoring and flow of the traffic.

When I did this to a cloud provider, I just built the two tunnels and used Policy Based Forwarding.

Resource list for VPN's.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clh5CAC

 

Hope this helps.

  • 1 accepted solution
  • 929 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!