topic Re: Policy Based Forwarding in General Topics

Policy Based Forwarding

LCMember4417 — Sun, 28 Aug 2011 15:09:40 GMT

We have a branch in a different state to which we have a DS3 MPLS circuit. We and our branch office have there own ISP connections for Internet access. I would like to have redundancy build between both of our companies through IPSec VPN tunnel in the event of DS3 goes down. So my question is can I use PBF's to achieve the redundancy. Is PBF capable of monitoring the next hop link and failover to the next PBF's. Can any one suggest me which path should I take to achieve the auto failover of my DS3 to IPsec VPN tunnel.

Re: Policy Based Forwarding

skrall — Thu, 08 Dec 2011 17:33:07 GMT

IF the IPSEC tunnel is the backup and the MPLS link is the preferred route, then do the folloing.

1) Set the routing table to choose the tunnel as the best route.

2) Configure a PBF rule that sends traffic out the MPLS link

-- The PBF needs to monitor the next hop or a device along the MPLS path

-- You can not use PBF to redirect traffic that originates/terminates on the Paloalto

For example:

If your IPSEC tunnel uses eth1 as an endpoint and exits eth1 to build that tunnel, PBF can not be useto redirect the eth1 IPSEC out eth2 instead.

Steve Krall

Re: Policy Based Forwarding

rob.burgoyne — Wed, 15 May 2013 08:09:28 GMT

I am looking for this exact configuration. Were you able to get it working as expected using PBF?