More thoughts: The vpn would build on the internal interfaces since the ISP for one side is down. - You’re correct, I’m planning to build the tunnel via the Internal Interface on PAN Firewall The PA default route for the down ISP goes into the tunnel - I’m planning to used PBF together with the built-in monitor to track the site ISP connections and once it is down, default route will be routed to VPN Tunnel. Do I need to create two PBF for this scenario? There is only one PBF and one default route in this scenario on each device. this is what is outlined in the tech note. Dual ISP Branch Office Configuration On the PA with good ISP - return traffic to the other site needs to go into the vpn instead of the MPLS or the tunnel will be asymmetrical and fail - If I enable “Enforce Symmetric Return in PFB Rule? Does it reduce the complexity that you mention? The use of PBF is really not an option here due to the way the process works. Instead I think you would nat the tunnel traffic providing a unique route on each site just for tunnel usage. See this tech note. Configuring route based IPSec with overlapping networks NAT for internet access - Yes, I’ll do dynamic NAT translation for all traffic coming out of the VPN tunnel. Possible issue that I’m anticipating are the NAT translation for the public IP’s owned by ISP that having an issue. Any thoughts on this? I don't see how you can use the down ISP space as this will not return to the up ISP location. You will have to allocate and use nat space on the working ISP for this purpose. This could potentially work. With the issue I mentioned on point 1 previously needing to be tested. Whether this is easier than the MPLS routing solution I'm not in a position to judge. Both seem invovled.
... View more
