Static route to IPSec peers with dynamic IPs

[Carracido]

Hello Community!

We have 2 external interfaces, eth_1 holding the default 0.0.0.0/0 route and eth_2

We would like to use external interface n2 to build IPSec tunnels whose peers have dynamic public IP.

Is there a way to route the traffic to these dynamic peers over eth_2 without having to use default route over eth_1?

Thank you!

[TomYoung]

Hi @Carracido ,

If your VPN peers will be dynamic, you will need a default route to send traffic to them.  If you only want to use eth1/2 for VPN traffic, the following solution may work.

1. Enable ECMP with Symmetric Return.
2. Select Weighted Round Robin with weights of 100 for eth1/1 and 0 for eth1/2.
3. Configure your dynamic IPsec peers to connect to eth1/2.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/ecmp/ecmp-load-balancing-algori...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0

Thanks,

Tom