The reason for the multiple VRs is because both tunnels are up and running at the same time.

Make sure to define the destination interface on the 'Original Packet' tab for both Source NAT rules. Configure a Source NAT policy for both ISPs.Revert the traffic to use the routing table of the Secondary VR where all connected routes exist. As shown in the example below, set up the forwarding out of the Primary Interface, with monitoring to disable the rule, if the destination being monitored is not available.The firewall tells the PBF not to forward traffic destined to a private network, since it cannot route private addresses on the Internet (as there might be private network addresses that need to be forwarded out).To force the traffic out the Primary ISP interface, use the PBF Sourcing from the Trusted Zone:.Secondary VR routes for all connected interface will show up on the routing table as connected routes, and the route for the tunnel will be taken care of by Policy-Based Forwarded (PBF).

Secondary VR has the Ethernet1/4 attached with all the other interfaces, as shown below:.When the traffic is forced out the interface through the PBF, the traffic will know how to get back to the Secondary VR where the interfaces live. The Primary VR routes include the default route and return routes for all private addresses back to the Secondary VR, where the actual interfaces are as connected routes.Primary VR has Ethernet1/3 interface attached.

The purpose is to let all interfaces be known by connected routes and routes on the VR as their routing method when the Main ISP goes down.

Eth 1/4: 10.80.40.38/24 (connection to ISP2) in the untrust zoneĮach VR has an ISP Interface attached, but all other interfaces will stay connected to VR Secondary, as well as all future interfaces.

In this example, there are two virtual routers (VR). The configuration is identical on both firewalls, so only one firewall configuration is discussed. ISP1 is used as the primary ISP on Ethernet1/3. This setup is frequently used to provide connectivity between a branch office and a headquarters.

Automatic failover for Internet connectivity and VPN.

A single device with two internet connections (High Availability).

This document explains how to configure a Palo Alto Networks firewall that has a dual ISP connection in combination with VPN tunnels.

Palo alto pa3220