Hello, I have 2 PaloAltos, one is running on robust and redundant Corp internet ISP, another one on a remote location with 2 public ADSL (and miserable quality ofc !). My goal is to have a redundant IPsec link between the two PaloAltos : How would you achieve this ? I have several scenarios in mind: PA2 builds 2 tunnels (one from each ISP) all time and routing is done with BGP (or any other routing protocol), so if a link fails, that routing protocol will timeout and route will vanish from each PA, so traffic will fail to the remaining one. PA2 builds 1 tunnel at a time : a PBF will detect if ISP1 is dead and failover traffic to ISP2. This solution may not work as my lowcost ISPs don't have same public adress, so it would mean that PA2 needs to reset old tunnel before creating new one (does it even support this automatically?). What would be the timeframe of such failover also ? thank you in advance for your suggestions, feedback and questions ! Regards,
... View more
