topic Re: Policy Based Forwarding is not working for Secondary ISP in General Topics

Policy Based Forwarding is not working for Secondary ISP

Anees10 — Wed, 26 Oct 2022 07:33:43 GMT

We recently added a new Internet link to our PA-3020. We want only one server (10.1.12.130) to use it, so we configured the new internet link interface as layer-3 , assigned it a static IP, created a PBF policy that basically specifies the zone (internal) and the source IP (10.1.12.130) and the destination is any (negate 10.0.0.0/8) and the action is to forward traffic to egress IF 1/10 with next hop of 1.1.1.1

We also created a NAT rule : From internal zone to external zone, source IF 1/10 and source translation is dynamic-ip-and-port.

Finally, we created a security policy to allow traffic from that source to the internet.

We have one virtual route for the old ISP. It's my understanding that no VR is required when using PBF as no failover or redundancy is required between the two links.

The source server doesn't have internet connectivity. FW's Software Version is 9.1.14-h4. We don't use Panorama to manage it.

I spent countless hours with PA engineers and they confirmed that the setup looks good, but for some reason they couldn't figure out why this setup is not working.

any thoughts? Thanks in advance.

Re: Policy Based Forwarding is not working for Secondary ISP

rmfalconer — Wed, 26 Oct 2022 14:33:40 GMT

Does the traffic from the single server egress out ISP 1 even with the PBF in place?

Do the logs show anything interesting with rule hits, allow/deny, etc?

Any packet captures on any interfaces to track where the traffic is going?

Re: Policy Based Forwarding is not working for Secondary ISP

Anees10 — Wed, 26 Oct 2022 14:48:04 GMT

Thanks for your reply.

1. The single server doesn't have internet connectivity. It can still talk to the other servers on the LAN but it doesn't have internet connectivity.

2. Captures show that ARP requests are incomplete. This could be due to the fact that there is no VR configured for ISP2.

>show arp all
ethernet1/10 147.129.178.129 (incomplete) ethernet1/10 i 1

>show counter global filter packet-filter yes delta yes severity drop
flow_fwd_l3_noarp 7 0 drop flow forward Packets dropped: no ARP