topic Re: Two ISP Connection with some of my inside network going out one of the two in General Topics

Two ISP Connection with some of my inside network going out one of the two

zaheera — Fri, 24 Mar 2023 18:10:54 GMT

Greetings,

Looking for some assistance in a scenario below; keep in mind I do not have or wish to have SD-WAN

1. ISP1 services the inside and outside connections

2. ISP2 acts as a vpn portal for extenal staff to connect to the inside and route to ISP1

The problem.

I would like to force some of my inside servers (mainly backing up to the cloud) to use the outgoing connection of ISP2

I have a /29 address space for ISP1

Im think more towards the line of PBR however not sure if this is achievable.

Re: Two ISP Connection with some of my inside network going out one of the two

Raido_Rattameister — Fri, 24 Mar 2023 18:48:29 GMT

With static routes in virtual router you can only route based on destination IP.

If you need to make decision based on source IP/Zone then yes PBF is your best option.

Re: Two ISP Connection with some of my inside network going out one of the two

zaheera — Sat, 25 Mar 2023 00:58:44 GMT

Thank you very much for your response. I was wondering if PBR would require me to create a seperate Virtual Router? Seeing i'm only allowed to have one 0.0.0.0/0 route I was thinking if I create another Virtual Router I could point that 0-Route to the interface of my secondary ISP?

Re: Two ISP Connection with some of my inside network going out one of the two

Raido_Rattameister — Sat, 25 Mar 2023 01:23:36 GMT

When Palo needs to check route where to send traffic iit first checks PBF and if there is no matching policy then it will fall back to virtual router.

PBF policies take precedence over virtual router.

PBF and virtual router are not anyhow paired together.

Just create PBF policy to route specific traffic over ISP2 and you are done.