topic Re: Route based VPN with palo alto firewall in Firewall and Security Management

Route based VPN with palo alto firewall

an_technical — Wed, 17 Sep 2025 17:12:24 GMT

Hi Team,

we are trying to establish route based vpn with palo alto firewall as requirement is to have automatic tunnel and traffic failover from pa side as they are using 2 isp.
on palo alto side, they configured static route with path monitoring to track the ip so incase that ip is unreachable, it failover to secondary tunnel.

i want to know is this can be achieved through static routes. On palo alto side, failover happen but when traffic comes to checkpoint it still sending reply traffic through primary tunnel. Is there any way we can configure something like path monitoring that is in pa to monitor there tunnel interface ip?

Thanks

Re: Route based VPN with palo alto firewall

PhoneBoy — Wed, 17 Sep 2025 17:40:37 GMT

Is there a specific reason you do not want to use Dynamic Routing here?
In R82, we have an object type "Network Probe" that could potentially do what you're after here.

Re: Route based VPN with palo alto firewall

an_technical — Wed, 17 Sep 2025 17:43:06 GMT

Customer dont want to do use dynamic routing. Is there anyway we an achieve this?

Re: Route based VPN with palo alto firewall

the_rock — Wed, 17 Sep 2025 17:56:50 GMT

Through static route? I doubt it.

Andy

Re: Route based VPN with palo alto firewall

PhoneBoy — Wed, 17 Sep 2025 18:02:26 GMT

I imagine it would be similar to the configuration for AWS, which prefers Dynamic Routing: https://support.checkpoint.com/results/sk/sk100726