topic Re: Control outgoing per user with 2 ISP in General Topics

Control outgoing per user with 2 ISP

SergeAyotte — Thu, 15 Nov 2012 15:15:00 GMT

Hello all!

Newbie here on PA-500 (just installed yesterday ), PAN-OS 5

I have 2 Internet provider connected to my PA-500 (configured and initial set-up done by reseller), and I am looking in a way to control (by user or device IP) who could go out via ISP2/Untrust2, in other words, not everyone going out by the "default" ISP1/Untrust1 interface.

Thank you in advance for any pointer to docs or steps in a reply post!

Serge

Re: Control outgoing per user with 2 ISP

zarina — Thu, 15 Nov 2012 18:44:05 GMT

You can configure pbf to allow users from your lan to use ISP1 and dmz users to use ISP2. These documents will help you in configuring pbf and the scenarios it can be used for:

Re: Control outgoing per user with 2 ISP

SergeAyotte — Thu, 15 Nov 2012 18:53:38 GMT

Thank you sdarapuneni!

I'll have a look at the docs, and see.

Although I wonder about your answer since there is no "dmz users", everyone is on the same internal segment.

Thank you again!

Serge

Re: Control outgoing per user with 2 ISP

zarina — Thu, 15 Nov 2012 19:07:37 GMT

You can configure pbf for specific networks and/or users. As you are on 5.0, you can use the symmetric return feature which will ensure the traffic that came in through ISP1 will go out through the same interface. You can find more details on this in the admin guide. Hope this helps!