Site to Site tunnel
Showing results for 
Search instead for 
Did you mean: 

Site to Site tunnel

L2 Linker



I have a question about the configuration of the ipsec tunnel, in the article when the tunnel interface is created


"Optional) If you want to assign an IPv4 address to the tunnel interface, select the IPv4 tab, and Add the IP address and network mask, for example"


That "Optional" address, what should it be? from my network, anyone?


I also wanted to consult once the monitor profile was created to know if the tunnel is UP or DOWN, when I select "failover". How should the PBF rule be with another ISP? I am looking for the tunnel to be UP in case the principal no longer responds and performs failover.


Could someone explain to me?


Thank you!


It can be any IP.

Enterprise Architect @ Cloud Carib


While it can be any IP. I always recommend you use one that is as close to the VPN endpoint as possible. So yes I would recommend the Tunnel IP. 



Lets say I have the following:


switchA --PANA--VPN--PANB--switchB


If I use switchB's IP for the PANA monitoring, if that switch goes down/reboots the tunnel will fail over.

If I use PANB's IP for PANA monitoring, it will only fail over if the IP of PANB is not reachable.


Just my thoughts.

Hi Raido and Otakar


Thanks for your assistance, it is really useful


I have Tunnel 1 and Tunnel 2 (Backup). Both phases are OK, green, but in the main interface "Tunnel 1" the status appears in red.


I read this article:

Phase 1 - OK
Phase 2 - OK
Status = Red


"RED indicates that the tunnel interface is down because the tunnel monitor is enabled and the remote tunnel monitoring IP address is unreachable."


I disabled the PBF policy and Tunnel 2, but traffic continues to come out of tunnel 2, I can not understand.


Would they know what it could be?

Here comes my doubt too

Network - IPSec Tunnels


Here I put the profile and the IP address is that of a host that is 24 hours UP on the other side.

In the PBF

Policies - PBF


Here it is necessary to place

 the IP address again if I choose the profile?



In "Destination" within the PBF should I enter the network address? or the address of the Gateway?






I do not understand well the operation of "Negate"


Negate just means 'Not Equal To' so lets say you want everything to route except a specific /24 you would enter that /24 network and select negate.


The monitor is just a ping so it can be anything. The PBF is a route so it needs to be the IP of the next hop router.


If the interface is Red, then its down and something is not happy, i.e. needs to be investigated.


Hope that makes sense. 

Hi Otakar,


Thanks you so much for your assistance

Really it help me


its necessary the "negate" or if I don't check this happens something?


Thanks for the PBF, then I'll put the IP of the next router there.





So the Negate translates to "not equal to'. Let ssay you have on your internal network. Now lets say you want all traffic 'except' a certain subnet(s). This is where you would use negate so that the rule is 'cleaner'



i dont want the policy to apply to the following subnets: and 

If you were to apply a 'Permit' policy you would have to list out all the subnets except those you dont want. So instead you use the Negate. 


What this does is allows all subnets 'Except' the ones listed.


Hope that makes sense.

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!