Second backup endpoint for IPSEC tunnel

[OzkanOzdil]

How do I best configure a backup IPSEC endpoint in an IPSEC tunnel if the primary endpoint goes down?

NOTE : Palo Alto on both sides

[reaper]

you can use an FQDN instead of an IP and then rely on dynamic DNS to switch the tunnel over, or you can create a second ike gateway and ipsec tunnel with secondary IP addresses (2 active tunnels) and use policy based forwarding for example to pick the preferred tunnel

[OzkanOzdil]

It would be more convenient to do it using IP addresses (2 active tunnels), but when the tunnels are down, will it automatically switch to the other one or do I have to do it manually?

Is there a document I can review about this?

[reaper]

once both tunnels are established, you do need to set up tunnel monitoring to make sure the tunnel goes _down_ when the remote side is disconnected. this will bring down the tunnel and impact routing. additionally you can have path monitoring in your routes or PBF that also monitor if a path is still available and reroute packets if the primary path is unavailable