This repository showcases a realistic enterprise firewall lab designed and implemented using Palo Alto Networks firewalls (PAN-OS).
The project demonstrates hands-on experience in network security architecture, focusing on high availability, secure site-to-site connectivity, and dynamic routing using BGP.
It reflects scenarios commonly found in medium to large enterprise environments.
This lab was built to demonstrate the ability to:
- Design resilient security architectures
- Implement enterprise-grade VPN solutions
- Use dynamic routing (BGP) to improve scalability and maintainability
- Ensure service continuity through High Availability
- Validate, troubleshoot, and document complex firewall deployments
This is not a basic configuration exercise, but a production-oriented design simulation.
- Palo Alto Networks Firewall configuration (PAN-OS)
- Route-Based Site-to-Site IPsec VPN
- BGP configuration and troubleshooting
- High Availability (Active/Passive)
- Virtual Routers and security zoning
- Network design and segmentation
- Failover testing and traffic validation
- CLI-based verification and operational troubleshooting
- Technical documentation and design rationale
- Two enterprise sites connected via redundant IPsec tunnels
- BGP peering over tunnel interfaces for dynamic route exchange
- Firewalls configured in High Availability to avoid single points of failure
- Clean separation of:
- Trust / Untrust zones
- Tunnel zones
- Virtual routers
- Designed to allow transparent failover without manual intervention
Validation includes:
- BGP neighbor establishment and stability
- Route propagation across tunnels
- Tunnel monitoring and status checks
- HA failover without traffic loss
- End-to-end traffic verification between sites
- RFC1918 IP addressing
- Private AS numbers for BGP
- No real credentials, licenses, or production data
- Configurations sanitized for public sharing
The complete step-by-step documentation, including screenshots,
detailed explanations, and validation outputs, is available here:
Notion Documentation
https://frost-bridge-ea2.notion.site/Redundant-VPN-with-Multiple-ISPs-2dea4cc3352b80af9f9ee247091dc0f4
This project is relevant for positions such as:
- Firewall Engineer
- Network Security Engineer
- Security Architect (Junior / Associate)
- Infrastructure Security Engineer
- Cybersecurity Engineer
Aaron Hidalgo
Cybersecurity professional with hands-on experience in firewall management, network security, and enterprise network design.
Focused on building secure, scalable, and maintainable security architectures.