Site to Site tunnel

[SebastianRM]

Hello

I have a question about the configuration of the ipsec tunnel, in the article when the tunnel interface is created

"Optional) If you want to assign an IPv4 address to the tunnel interface, select the IPv4 tab, and Add the IP address and network mask, for example 10.31.32.1/32."

That "Optional" address, what should it be? from my network, anyone?

I also wanted to consult once the monitor profile was created to know if the tunnel is UP or DOWN, when I select "failover". How should the PBF rule be with another ISP? I am looking for the tunnel to be UP in case the principal no longer responds and performs failover.

Could someone explain to me?

Thank you!

[SebastianRM]

Hi Otakar,

Thanks you so much for your assistance

Really it help me

its necessary the "negate" or if I don't check this happens something?

Thanks for the PBF, then I'll put the IP of the next router there.

[OtakarKlier · Accepted solution]

Hello,

So the Negate translates to "not equal to'. Let ssay you have 192.168.0.0/16 on your internal network. Now lets say you want all traffic 'except' a certain subnet(s). This is where you would use negate so that the rule is 'cleaner'

example:

i dont want the policy to apply to the following subnets: 192.168.199.0/24 and 192.168.66.0/25. 

If you were to apply a 'Permit' policy you would have to list out all the subnets except those you dont want. So instead you use the Negate. 

What this does is allows all subnets 'Except' the ones listed.

Hope that makes sense.