topic Re: PBR using Route failover in Next-Generation Firewall Discussions

PBR using Route failover

vishalrsshah — Sun, 14 Apr 2024 18:08:43 GMT

Hi All,

Our organisation purchased two Mpls link and wants to configure an PBR like such

1) All intranet traffic like dns, ntp shoud go via primary MPLS

2) All internet related traffic should go via Secondary MPLS

3) In case Primary MPLS goes down all traffic (intranet and internet) should go via Secondary MPLS and vice versa.

Please let me know how i can achieve this. Attached Sample Diagram.

Re: PBR using Route failover

vishalrsshah — Sun, 14 Apr 2024 18:09:56 GMT

PFA diagram

Re: PBR using Route failover

rmfalconer — Mon, 15 Apr 2024 17:15:06 GMT

Are you talking PBR on the routers or PBF on the firewalls?

Re: PBR using Route failover

vishalrsshah — Mon, 15 Apr 2024 17:40:25 GMT

Pbf on firewalls alongwith route redundancy using static route monitoring

Re: PBR using Route failover

rmfalconer — Mon, 15 Apr 2024 19:53:09 GMT

If you really want to use PBF on the PA, you could put RFC 1918 toward primary and negate RFC1918 toward secondary. You'll need a default toward each of them as well for the failover to work.

Re: PBR using Route failover

vishalrsshah — Thu, 18 Apr 2024 06:10:20 GMT

Could you pls elaborate with statement 'you could put RFC 1918 toward primary and negate RFC1918 toward secondary'. if possible pls share any relatable link.

thanks in advnace.

Re: PBR using Route failover

rmfalconer — Thu, 18 Apr 2024 15:20:57 GMT

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/policy-based-forwarding/create-a-policy-based-forwarding-rule

You can set destination addresses as part of the policy.