05-07-2019 08:08 AM
Hello, I have two PAs and want to build IPSec tunnels between them. one PA A has a static IP. The other PA B has two internet connections. One with a static IP and one with a dynamic IP. Now I want to build two tunnels from device B to the A side. my two internet interfaces eth 1/4 has the IP 192.189.5.4 and the router behind it has the IP 192.168.5.1. What should my routing look like? Both interfaces are in the same default VR. There I have a route 0.0.0.0/0 on interface eth 1/1 where my main internet connection is. My other side where the tunnel should terminate is the 1.1.1.1 IP.
Don't really know right now.When my tunnel from eth 1/4 now start, it will go to the untrust zone of eth 1/1.
Where can I find helpful information?
05-07-2019 11:42 AM
Hello,
As for the VPN, here is the article you would want to read:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0
As for routing, you have several choices:
OSPF with one VPN path having a higher cost of say 10000
Static with route monitoring, .e.g the route will be removed if the far end IP is not reached
Policy based forwarding with monitoring, e.g. the PBF rule will not take affect is the far end IP is not reached.
The way I have done it in the past is assign IP to the Tunnel interfaces, like /30's and then make the far side /32 routing using static routing. So if the tunnel is down the IP is never reachable since its static routing and the other protocols are of lower value.
Hope this makes sense. Let me know if you would like clarification.
Cheers!
05-07-2019 11:42 AM
Hello,
As for the VPN, here is the article you would want to read:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0
As for routing, you have several choices:
OSPF with one VPN path having a higher cost of say 10000
Static with route monitoring, .e.g the route will be removed if the far end IP is not reached
Policy based forwarding with monitoring, e.g. the PBF rule will not take affect is the far end IP is not reached.
The way I have done it in the past is assign IP to the Tunnel interfaces, like /30's and then make the far side /32 routing using static routing. So if the tunnel is down the IP is never reachable since its static routing and the other protocols are of lower value.
Hope this makes sense. Let me know if you would like clarification.
Cheers!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
