topic Redirecting certain websites to backup PA? in General Topics

Redirecting certain websites to backup PA?

Tadija — Tue, 23 May 2023 00:34:17 GMT

Hi,

Is it possible to redirect websites to route to our secondary data centre rather than our primary?

There is a PA850 at each of the sites, but for some reason our main data centre is being 403 Forbidden blocked, or being blocked for being behind a "vpn" which it isn't.

Basically I just want to set it up so if people go to www.example.com it will redirect to our secondary data center and exit via that PA's ISP link.

Cheers,

Tadija

Re: Redirecting certain websites to backup PA?

reaper — Tue, 23 May 2023 16:14:59 GMT

yes, but 'how' will depend greatly how both datacenters are connected and where www.example.com is hosted

you can use policy based forwarding to redirect the connection to site B, for example, and then on site B rely on regular routing and NAT to get to the site. It may require you to build a site to site tunnel if you don't have an interconnection yet

Re: Redirecting certain websites to backup PA?

Tadija — Tue, 23 May 2023 22:56:43 GMT

The datacentres are linked via MPLS and the core switches can see each other via BGP.

I tried to use PBF but most of these sites are using something like AWS where there have multiple IP addresses, and I couldn't seem to find a way to get the PA to use a URL rather than an IP address.

I wasn't able to forward any traffic even with using an IP address however - This is the first time I've tried to do any policy based forwarding.

Re: Redirecting certain websites to backup PA?

Raido_Rattameister — Wed, 24 May 2023 12:18:08 GMT

You can't do routing based on URL.

You can do it using FQDN address objects.

If you did test using IP in PBF.

Did traffic reach to DR firewall?

What logs show? Was NAT applied to outgoing traffic?

Were there return packets in DR firewall? What about HQ firewall?