- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-13-2025 12:05 AM
Hello.
so I need to setup a dual ISP setup and found below kb.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLL8CAO
I know there is also one using different virtual routers but for this specific setup it seems this one is a slightly better match.
however 1 thing in the kb bothers me and in the past when I did this setup I did it slightly different but I'm not sure if it's the best option.
It's in regards to the route monitoring config.
the kb states that you should/can configure the default gateway of the isp as the next hop to monitor. this is fine if the ISP device( router/whatever) onsite goes down or there is an issue with the interface.
however if the onsite device is fine but the further connection to internet is impacted it won't fail over.
the router is still responding to the ping, so no issue, all network traffic will time out due to the router's next hop being unreachable.
(I suspect
How I "fixed" this in a previous setup was by defining a host route to a specific server over each isp ( in my case both isp also hosted local dns servers that responded to ping.
so I configured a hostroute to each dns server to always go over 1 isp and then use those for the path monitoring.
pro:
I monitor an actual connection that needs to get on the internet and back. not just the next hop.
con:
If anyone uses those dns servers for actual dns they will be impacted if one link is down as those routes don't failover.
if those dns servers of one ISP have an issue it will trigger a false failover.
it's not pretty with those /32 routes.
Is there a better way to do this? or is this the way (despite the con's
01-13-2025 06:23 PM
Hello @TommieVanHove ,
If you can perform a BGP peering with you, I think you don't need to do the route monitoring.
Olivier
PCSNE - CISSP
Best Effort contributor
Check out our PANCast Channel
Disclaimer : All messages are my personal ones and do not represent my company's view in any way.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!