Palo Alto Networks PA- 450 Next‑Generation Firewall to maintain uninterrupted BSNL SIP trunk services in the event of a primary internet link failure.

[pradip.joshi]

Please provide comprehensive and step‑by‑step instructions for configuring a Palo Alto Networks PA- 450 Next‑Generation Firewall to maintain uninterrupted BSNL SIP trunk services in the event of a primary internet link failure. The BSNL SIP Trunk Server which is on cloud having a static IP of 117.198.215.109 & BSNL SIP trunk is presently bound to a static public IP 116.74.149.94, which is allocated to the primary internet circuit. The requirement is to automatically reroute all BSNL SIP traffic through the secondary internet circuit having static IP 117.139.107.109 whenever the primary link becomes unavailable, while retaining the static SIP source IP of the primary line.

[Raido_Rattameister · Accepted solution]

For firewall to be able to keep same public IP after failing over to secondary link you need to own /24 or bigger public subnet (as /24 is smallest network you can advertise into public BGP) and you need to set up BGP peering with both ISPs and advertise out your public IP range.

Without BGP peering you can't keep same public IP after failover to secondary ISP as even if ISP don't filter what source IP you send traffic into ISP 2, no traffic will be routed back to it.