Configure the Remote Network Tunnel

From the Silver Peak orchestrator, create a tunnel configuration.
Select
Configuration
.
Select
Tunnels
Passthrough
Select
Add Tunnel
.
Select a
Name
,
Local IP
,
Remote IP
, and
Mode
.
In the
Advanced Options
area, enter the IKE and IPSec parameters.
The parameters must be the same as the parameters that you specified on Prisma Access. Silver Peak recommends the following IKE and IPSec encryption settings:
IKE encryption settings:
Encryption
—AES-256-CBC
Authentication
—SHA512
IKE Lifetime
—8 hours
Dead Peer Detection
—
Delay time:
300 seconds
Retry:
3
IKE Identifier
—IP address (leave blank - public IP is auto-detected)
DH
—Group 14
Mode
—Aggressive
IPSec encryption settings:
Encryption
—AES-25-CBC
Authentication
—SHA512
Lifetime
—60 minutes
PFS
—DH - Group 14
Create two tunnels to Prisma Access: one Active and the other Backup.
The following example creates two tunnels named
GlobalProtect-1
and
GlobalProtect-2
.
Specify the Prisma Access
Service IP Address
in the
Remote IP
field.
Select the
Local IP
address from the list of WAN interface IP addresses.

Use the 3rd party IPSec tunnels in a Business Intent overlay policy by selecting
Business Intent Overlay
and configuring the
Peer/Service
in the
Policies
area.
Order the
GlobalProtect-1
GlobalProtect-2
service to the
Preferred Policy Order
field in the Internet Traffic area.

Defining the order in the
Preferred Policy Order
configures the GlobalProtect-1 tunnel to automatically fail over to the GlobalProtect-2 if the GlobalProtect-1 goes down. When both tunnels from the branch to GPCS are down, Silver Peak uses any other defined path such as local breakout or backhaul using the Overlay.