Tunnel monitoring between plao alto and policy based cisco vpn

[Aaida]

I am thinking about possibility of doing a tunnel monitoring from palo alto to cisco route vpn which is configured in policy based mode.

Do palo alto supports below configuration to do so.

1. Set up /32 IP in tunnel interface of palo alto

2. Configure tunnel monitoring to Peer IP of peer cisco.

Do this work?

[S.Cantwell]

Good Day

Yes the PANW supports tunnel monitoring to monitor the remote side of the tunnel. 
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/vpns/set-up-site-to-site-vpn/set-up-tunnel...

[TomYoung]

Hi @Aaida ,

As @S.Cantwell said, it will work.  With regard to your second point, the "Peer IP" should not be the public IP address of the Cisco, but rather an IP address that is routed over the VPN, preferable a device that will never be turned off.

What is your intended purpose of tunnel monitoring, to keep the tunnel up or something else?

Thanks,

Tom

[Aaida]

Hello Tom,

My intention is to monitor tunnel and auto failover.  So if we monitor peer Ip of cisco, we can achieve auto failover right 

[TomYoung]

Hi @Aaida ,

Excellent.  Yes, you can set the Tunneling Monitoring Profile to Fail Over, and when the IP is unreachable, it will shut down the tunnel interface and remove the routes to the tunnel.  You will need to have an alternative path, another VPN tunnel or something.

Please stop saying "monitor peer IP."  It sounds like you are talking about the public VPN peer IP address.  That is not how it works.  You need to monitor an IP address reachable via the VPN tunnel.

Thanks,

Tom

[Aaida]

Thank you so much Tom, so what about routers internal interface ip,  we can monitor that right

[TomYoung]

Yes, sir!

[Aaida]

Thanks @TomYoung @S.Cantwell  for your help.