PBF SMTP for both ISP1/ISP2

Sun, 07 May 2017 21:00:07 GMT

I'm wondering if anyone has a similar setup and got it working. I'd like to have both SMTP services enabled on two ISPs for load-balancing and redundancy. I tried using PBF but couldn't get it working. It seems SMTP for ISP1 works fine but SMTP for ISP2 comes into the firewall but the application is incomplete. Which tells me the 3 way handshake is not completing. I took a pcap and didn't see any drops however. I followed the articles below as guidelines:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Symmetric-Return/ta-p/59374

eth1/1.2 ISP1 1.1.1.1

eth 1/1.3 ISP2 2.2.2.2

Inside 10.1.1.1 - STMP server is 10.1.1.25

Security allows SMTP traffic to both ISPs

NATs for both ISPs (inbound and outbound on SMTP service)

Default route is 2.2.2.2

PBF to force symmetric return if interface comes in from from eth1/1.3

PBF forces browsing to 1.1.1.1

From what I can tell all the policies that I've defined are being hit and symmetric return is being acknowledged but the traffic is not going through. Traffic for ISP1 is identified as SMTP but for ISP2, it is incomplete.

I've got a TAC opened but also wanted to check with our awesome community!

Thanks folks!

Re: PBF SMTP for both ISP1/ISP2

Jacopo_Vigano — Mon, 08 May 2017 08:01:55 GMT

Hi @x,

do you have a single Virtual Router with attached both ISPs?

I suggest you to follow this article:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774

You need to follow this article without the VPN parts.

I have already done the same configuration you described and it works fine.

Let me know.

Jacopo

topic Re: PBF SMTP for both ISP1/ISP2 in General Topics

PBF SMTP for both ISP1/ISP2

Re: PBF SMTP for both ISP1/ISP2