ISP Failover with dual Dynamic Public IPs?

[Bill-Jerome]

Hello,

I have two ISPs with Dynamic Public IPs.  Is there a way to setup ISP failover?

Thanks,

Bill

[TomYoung]

Hi @Bill-Jerome ,

Great question.  I don't think it can be done with 1 NGFW because both static route path monitoring and PBF require a next hop to be configured.  As I understand your scenario, your default routes are learned dynamically.  However, with 2 NGFWs, you could enable Path Monitoring with 1 ISP on each NGFW.  If you wanted to load balance between the two, it can be done but would be complicated.  Primary/Standby would be the easiest scenario.

It is very important that you use multiple Internet IP addresses and set your Failure Condition to all so that if one Internet server goes down you do not fail over.

Thanks,

Tom

Edit:  How often do your IP addresses change?  You could do it with 1 NGFW and update your next hops whenever the IP address changes.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLL8CAO

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/policy-based-forwarding/use-case-pb...

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/device/device-high-availabil...

[Bill-Jerome]

Thanks for the feedback.  I was thinking about the next hop option too but was hoping for a way to use a FQDN for the next hop but that seem like wishful thinking.  🙂

Thanks,

Bill