PanOS6 - Redundant VPN Tunnels

[gafrol]

Hi all,

I cannot find an easy solution to this problem of having an automatic failover once the primary VPN tunnel goes down. Goal is to have both Tunnels up and runnig at the same time, once the primary VPN tunnel dies it will automatically use the other remaining backup tunnel. Remote Peer IP (195.186.255.x) stays the same for both tunnels. Currently the VPN is up and running through the Primary VPN Path only.

Any ideas ? Thanks

Currently there is one VR with a static route to 195.186.255.x via SC Router 1. The LAN behind VPN EP Cisco is routed into Tunnel.1 interface.

[pankaku]

Please refer to following document

How to Configure a Palo Alto Networks Firewall with Dual ISPs and Automatic VPN Failover

[santonic · Accepted solution]

Fail-over tunnel monitoring profile on both tunnels, 2 static routes with different metric for network behind VPN, each directing into one tunnel interface.

[gafrol]

Still does not solve the Tunnel remote Peer IP Problem. Cannot have multipath routes to same remote peer IP at the same time, except for PanOS7 and ECMP.

I guess we need to have a second remote Peer IP Address in order to have both tunnels up at the same time.

[santonic]

Ahh, thought you already have both tunnels up. I usually do such scenario with 3 VRs, one for each ISP or external interface (so you can have multiple default routes) and one VR for local interfaces including tunnel interfaces. Then you can have both tunnels up all the time.

[gafrol]

Interesting approach thank you. I will give it a try.