topic Re: destination port in PBF in General Topics

destination port in PBF

ceapen01 — Tue, 01 Feb 2022 12:16:22 GMT

Is there an option to define destination port in PBF. Now if a service is selected, PA applies PBF if source or destination has that port.

I am looking for a PBF which should match only if destination port is 80.

Re: destination port in PBF

BPry — Wed, 02 Feb 2022 02:22:37 GMT

@ceapen01,

When you specify the service in a PBF that refers to the destination service (or port), not the source service/port. PBF wouldn't really be a lot of good in a lot of cases if the service object was applied to both source and destination.

Re: destination port in PBF

S.Cantwell — Wed, 02 Feb 2022 02:22:50 GMT

Hello there.

If you match only on port 80, you will be matching 1930 applications. I need to ask the question.. WHY?
PBF is used to supercede the routing table.
Do you have more than one ISP?

What is the business justification, as we would probably NOT recommend this, as it will probably not work as expected.

Re: destination port in PBF

ceapen01 — Wed, 02 Feb 2022 05:30:59 GMT

Thank you @S.Cantwell and @BPry

@BPry I checked the session id details. PBF was being used even when source port is 80. Attached screenshot below.

@S.Cantwell i have added a scenario diagram below. PBF requirement is to route incoming web requests to 10.20.30.12 via INT 2. The DNAT for public IP has a source NAT with INT 2 interface IP, so that DC firewall sees source IP as PA FW INT 2.