topic Re: PA-200 - Passing traffic through multiple ISP links in General Topics

PA-200 - Passing traffic through multiple ISP links

Retired Member — Sun, 12 Jun 2016 10:10:16 GMT

I have a Palo Alto PA-200 and the setup I'm trying to configure is as below.

I'm using "Fiber1" and "Fiber2" for Internet purpose. These 2 links are connected to firewall via a trunk port.
The ADSL links and the "LankaCom" link in the right are using for mail purpose only. These 3 links are also connected to the firewall via a trunk port
Sub-Interfaces are created in firewall as 1/1.60, 1/1.61 and 3/3.62, 3/3.63, 3/3/64.
I have managed to configure the Fiber links successfully and I'm accessing the Internet through them.
But I can't get to work the ADSL links for mail access.
I have only created 2 Zones as of now (Trust & Untrust) and trying to pass the traffic using them.
Do I have to configure another zone to transfer mail traffic to ADSL side.?
Is it possibe to configure this scenario in PA-200.?

Re: PA-200 - Passing traffic through multiple ISP links

Raido_Rattameister — Sun, 12 Jun 2016 11:43:31 GMT

Can you explain what you mean by mail acess.

Are you receiving mail or users are using mail client to pull mail in from mail server?

Re: PA-200 - Passing traffic through multiple ISP links

Transporter — Sun, 12 Jun 2016 11:29:50 GMT

Create additional zone for ADSL links and the "LankaCom" (interfaces 3/3.62, 3/3.63, 3/3/64) and DMZ. And allow specific traffic you need. Make sure your routing table correct

Re: PA-200 - Passing traffic through multiple ISP links

taviss — Sun, 12 Jun 2016 17:15:41 GMT

Can you show us the routing table? I am assumping each DSL has it's own IP and interface. How are you telling the traffic what interface to go to? Are you using policy based routing? or doing static routes?

Re: PA-200 - Passing traffic through multiple ISP links

Retired Member — Mon, 13 Jun 2016 04:22:56 GMT

There are 2 mail servers in DMZ zone. One server for Admin staff and one for general staff. Only the ADSL links and the LankaCom link has the public IP's. LankaCom link is used for mail transfering to both servers. In case lankaCom link fails, ADSL links are used as backup links for each mail server.

Re: PA-200 - Passing traffic through multiple ISP links

Retired Member — Mon, 13 Jun 2016 04:25:13 GMT

VIRTUAL ROUTER: Default_SLT-FL-LAN (id 3)
==========
destination nexthop metric flags age interface next-AS
0.0.0.0/0 10.100.60.1 10 A S ethernet1/1.60
0.0.0.0/0 10.100.61.1 15 S ethernet1/1.61
10.100.60.0/24 10.100.60.254 0 A C ethernet1/1.60
10.100.60.254/32 0.0.0.0 0 A H
10.100.61.0/24 10.100.61.254 0 A C ethernet1/1.61
10.100.61.254/32 0.0.0.0 0 A H
192.168.15.0/24 192.168.45.254 10 A S ethernet1/2
192.168.20.0/24 192.168.45.254 10 A S ethernet1/2
192.168.30.0/24 192.168.45.254 10 A S ethernet1/2
192.168.45.0/24 192.168.45.253 0 A C ethernet1/2
192.168.45.253/32 0.0.0.0 0 A H
192.168.100.0/23 192.168.45.254 10 A S ethernet1/2
total routes shown: 12

VIRTUAL ROUTER: VR2_SLT-AD-LC (id 4)
==========
destination nexthop metric flags age interface next-AS
10.100.1.0/24 10.100.1.100 10 S ethernet1/3.62
10.100.1.0/24 10.100.1.253 0 A C ethernet1/3.62
10.100.1.253/32 0.0.0.0 0 A H
20.100.2.0/24 20.100.2.100 10 S ethernet1/3.63
20.100.2.0/24 20.100.2.253 0 A C ethernet1/3.63
20.100.2.253/32 0.0.0.0 0 A H
192.168.2.0/24 192.168.2.253 0 A C ethernet1/3.64
192.168.2.0/24 192.168.2.254 10 S ethernet1/3.64
192.168.2.253/32 0.0.0.0 0 A H
total routes shown: 9

Re: PA-200 - Passing traffic through multiple ISP links

Retired Member — Mon, 13 Jun 2016 04:38:43 GMT

I have used Policy based routing to transfer traffic through fiber links. Fiber links are working in failover mode. I have added a static route in core switch to transfer mail traffic to DMZ zone. But with what I'm experiencing, this route doesn't work since all the traffic are going through fiber links.