VPN over Multiple ISP connections

Showing results for 
Show  only  | Search instead for 
Did you mean: 

VPN over Multiple ISP connections

L1 Bithead



I am new to the PA world and I have the following design been given to setup. I am trying to find the best way to do this. I have done in Fortinet by creating SDWAN interface and it worked but not sure if Palo has the same kind of setup. If someone help me that would be great. 



Site Firewall -- 1.100 and 1.200 ( sub interfaces ) -- ( Trunk Vlan 100, 200 ) L2 SWITCH ( Port 10 - V100 - ISP 1, Internet) , ( Port 20 - V200 - ISP2 , Internet) -- ( DC , PA , VPN over internet Internet )  -- Rest of the network



I need to make sure, as long as I have internet connection , either via ISP1 or ISP2, My tunnel stays up. 


One of the solution I can think of is using the default route via ISP1 setup a tracking and use the second  default route via ISP2.


Use virtual interface ( Public IP) on the Site firewall to create the tunnel source to the Destination. 


If the Public IP is not available then use the interface IP and stand up two tunnels from each of the ISP and then use BGP to navigate the routing. 


I am not sure if there is any other smart way to do this. I used to combined this two connection to One virtual interface in fortinet and use that interface to create the tunnel so regardless which ISP is active tunnel and routing always find a way. 


Please help me with some guidance. 



Cyber Elite
Cyber Elite


There are several ways to accomplish this. Obviously build the two tunnels, then you have routing options:

  1. Policy Based Forwarding - Setup a policy to send all traffic via the preferred tunnel and set a monitor, disable this rule..., and Enforce Symmetric return. Choose an IP address on the other side of the tunnel that should be up, ie the internal management interface of the other vpn endpoint etc. Then a static route pointing at the secondary tunnel. PBF takes effect before the virtual router.
  2. Static routing - setup static routes with metrics and path monitoring. Leave the primary route with the default metric and set the secondary with something high like 10000. then you have to do the same on the other vpn endpoint.
  3. Dynamic routing - This is what I usually setup with OSPF, same as static routing.

Hope this makes sense, please feel to ask additional questions etc.



  • 1 replies
  • 38 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!