ikev2 site to site VPN to sites with multiple public ip addresses(used for failover)

[msdphi]

for a client, i created these many tunnel interfaces for each of their sites. Now, for all these sites, they have 2-3 public ip addresses(for failover purposes). So, will i have to create new tunnel interfaces or should I just create new Ike gateways and ipsec tunnels and point them to the tunnels which I created earlier(shown on the screenshot below)? Please help

[OtakarKlier]

Hello,

I think your answer would depend on how you plan to use the tunnel interfaces. You can assign multiple IP's to a singe interface. However for me, I use the interfaces for OSPF routing and to see if the tunnel is up, via 3rd party monitoring since the tunnels connect via different providers.

Regards,

[msdphi]

I want to know how to configure policy based site to site VPN from our Palo Alto to a site which has a watchguard firewall and has 3 public ip addresses(used for failover).

[OtakarKlier]

Hello,

Is a watchguard a route based or zone based firewall? Palo Alto is route based.

Regards,

[msdphi]

I am not sure about that. That is on the client's side.

[msdphi]

I am just configuring on panorama. I have already configured VPN to their primary public IP. I am not sure if I can point the same tunnel to the newly created ike gateways and ipsec tunnels for their branch sites. 

[OtakarKlier]

Hello,

You should be able to, however make sure your routing is set so that its not going to use multiple tunnels unless you are using ECMP.

Regards,