VPN over Multiple ISP connections

[gondolf]

Hi,

I am new to the PA world and I have the following design been given to setup. I am trying to find the best way to do this. I have done in Fortinet by creating SDWAN interface and it worked but not sure if Palo has the same kind of setup. If someone help me that would be great. 

Site Firewall -- 1.100 and 1.200 ( sub interfaces ) -- ( Trunk Vlan 100, 200 ) L2 SWITCH ( Port 10 - V100 - ISP 1, Internet) , ( Port 20 - V200 - ISP2 , Internet) -- ( DC , PA , VPN over internet Internet )  -- Rest of the network

I need to make sure, as long as I have internet connection , either via ISP1 or ISP2, My tunnel stays up. 

One of the solution I can think of is using the default route via ISP1 setup a tracking and use the second  default route via ISP2.

Use virtual interface ( Public IP) on the Site firewall to create the tunnel source to the Destination. 

If the Public IP is not available then use the interface IP and stand up two tunnels from each of the ISP and then use BGP to navigate the routing. 

I am not sure if there is any other smart way to do this. I used to combined this two connection to One virtual interface in fortinet and use that interface to create the tunnel so regardless which ISP is active tunnel and routing always find a way. 

Please help me with some guidance. 

[OtakarKlier]

Hello,

There are several ways to accomplish this. Obviously build the two tunnels, then you have routing options:

1. Policy Based Forwarding - Setup a policy to send all traffic via the preferred tunnel and set a monitor, disable this rule..., and Enforce Symmetric return. Choose an IP address on the other side of the tunnel that should be up, ie the internal management interface of the other vpn endpoint etc. Then a static route pointing at the secondary tunnel. PBF takes effect before the virtual router.
2. Static routing - setup static routes with metrics and path monitoring. Leave the primary route with the default metric and set the secondary with something high like 10000. then you have to do the same on the other vpn endpoint.
3. Dynamic routing - This is what I usually setup with OSPF, same as static routing.

Hope this makes sense, please feel to ask additional questions etc.

Cheers!