PA220 PANOS 8.0.7 Dual ISP

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

PA220 PANOS 8.0.7 Dual ISP

L2 Linker

Hello Everyone

 

I know there is a fair amount of information on this topic but I have a few issues/questions

 

I have a PA220 with PANOS 8,0,7. My questions are relating to dual ISP connectivity. I would like to setup my PA with a backup ISP connection. I do have IPsec tunnels. But I am allowing for the second tunnel to negotiate when the backup ISP comes up. So both tunnels don't have to be "up and ready" 

 

I have read the following article which is based on 2 VRs with PBFs to push traffic to the primary ISP with monitoring. When monitoring fails it will "failover" to use the second ISP

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Palo-Alto-Networks-Fi...

 

I have also read the following article which I believe is now available in PANOS 8. This configuration use 2 default routes. The first 1 will have a lower metric. Let's say 10 with monitoring enabled and the second default route has a higher metric let's say 50. 

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/networking/static-routes/static-rout...

 

Basically can I achieve dual ISP with tunnels available on both untrusted ISP connections with the second article (default routes and path monitoring) Again I don't mind the short amount of time for tunnel negotiate. It's a branch office PA and I don't really want to configure 2 VRs.

 

Thank you, really appreciate any help on this

 

22 REPLIES 22

Cyber Elite
Cyber Elite

Hi @Nick.Spender!

 

yes, this should work

 

The first article highlights a scenario that guarantees minimum downtime because both your tunnels are up. If a short downtime is not a big concern you can simply use the static route removal in PAN-OS 8.0

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

@reaper

 

Thank you Reaper.

 

I am testing path monitoring route now.....lets see how it goes

 

Thank you for all your comments and replies

L2 Linker

@reaper

 

I am setting up each above article, currently testing the path monitoring method for static routes. When I fail over the ISP I get a real strange issue. its not tearing down the tunnel connected to 1/1

 

Untitled1.png

Did you enable tunnel monitor in the ipsec configuration?

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

@reaper

 

No....As the other side isnt a PA 😞

ah, that's a problem...

 

ok so how about you only create one tunnel locally, since the remote end will remain the same destination IP, and create a dynamic tunnel on the remote end (identification of PANW peer by means of email address or hostname for phase1 instead of it's IP)

then you could simply fail over the 1 tunnel to the second ISP and your remote peer will simply see a new tunnel com from a different source ip

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

@reaper

 

When you say "hen you could simply fail over the 1 tunnel to the second ISP and your remote peer will simply see a new tunnel com from a different source ip" is that a manual process? 

 

Thanks again 😉 

That should happen automnatically: your primary default gateway fails so your tunnel will resort to using the second default gateway to try and get to the remote end

 

thinking about this a bit more, maybe I should try reproduction in the lab... (haven't set this scenario up live yet, there may be complications)

 

there are a few complicating factors that could ruin the party

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

I will give it a go 

 

Thank you @reaper

@reaper 

 

On a side note...Do you think the other article (the 2 VR method) would cause the same issues? 

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Palo-Alto-Networks-Fi...

 

 

Hello @Nick.Spender,

I would just like to point out that you do not need two seperate VR's for this type of scneario. I have done it multiple times with just 1 VR and PBF with static route failover. THe other way is to use a dynamic routing protocol and add route costs to the link you call secondary.

 

Regards,

@OtakarKlier

 

But what the 2 default routes?

 

with 1 VR you cant use 2 default routes unless you use path monitoring for the 0.0.0.0/0 routes?

Hello,

There would only be one default route in the VR, e.g. the backup path. The PBF would be the primary route with a monitor and a disable option. Since PBF takes effect before the routing table, unless the PBF is down, the default route will not be used.

 

Hope that makes sense.

  • 5818 Views
  • 22 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!