Link and traffic priority on palo alto

[vishalrsshah]

Hi All,

We are using one isp link for internet browsing and 2 site to site tunnel. Now we have procure another isp link and want to configure it as a primary for internet traffic and one location (India) site to site vpn.

Below my approach to achieve this

1. Configure new isp link with lesser priority for interent traffic and one location (India) site to site and if its fails traffic divert to secondary isp. Will my secondary tunnel works with secondary isp, as im not creating with primary isp.

2. Create pbf rule to route internet traffic from primary isp and above create no pbf rule for site to site vpn, so vpn traffic will follow via normal static route and security policies.

[Elwin3]

Hey Vishal,

Just to confirm, you want the new ISP to be the primary link for internet and for the India VPN, and if it goes down, all traffic should switch to the secondary ISP, right? That can definitely work, but make sure the VPN is configured to use both ISPs, either by defining two IKE gateways or by setting up a proper failover. Otherwise, the tunnel won’t re-establish automatically through the backup link when the primary goes down.