PBF Monitor with tunnel Interface

[martin]

Hi,

I want to use PBF with IPSEC tunnel to handle failover.

I have 2 tunnels with the same proxy id, so I need to route a network between one tunnel, and if this tunnel is down I need to automatically route to the second tunnel.

But how to use monitoring in the PBF rule with a tunnel interface?

I think I have to configure a IP on the tunnel interface, but in which network ?

Can you help?

Thank you,

[sspringer]

Hello Martin,

You can the tunnel interface with any IP address as long as the IPSEC Peer is configured with the appropiate proxy ID/route.

For example, you can set the tunnel interface to 10.10.10.250/24 - this would require the peer to have 10.10.10.250/24 or 10.10.10.250/32 configured as the remote(PaloAlto) proxy ID.

Also, when configuring a IP address to 'monitor' you will want to set a IP address in the peer's proxy ID so the traffic will get pushed through the tunnel.

- Stefan