topic Re: Dual ISP scenario in General Topics

Dual ISP scenario

soporteseguridad — Thu, 22 Mar 2018 14:00:46 GMT

Hi,

I need to create a dual ISP scenario. This FW has 2 interface with differents ISP. (ppoe)

eth1/2 (1.1.1.1/32)

eth1/3 (2.2.2.2/32)

We would like to balance both ISPs and in the case one of this ISP goes down, all traffic takes the ISP up in that moment. So i was checking,

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Implement-ECMP-Load-Balancing-on-the-Firewall/ta-p/110339

Also i would like to force some trust range to take interface 1/2 (using PBF), an in the case this interfaces 1/2 goes down, to take int1/3

on the another hand, there are several services on internet for this public IP. So how ca we public the NAT in both ISP interface??? clonning all the NATs using the new ISP IPs??? thats enough i think

Re: Dual ISP scenario

reaper — Thu, 22 Mar 2018 14:08:49 GMT

Hi @soporteseguridad

outbound you would be ok with ECMP and using PBF policies to force certain traffic onto a specific interface

outbound NAT would simply be regular outbound hide-NAT with a destination interface set and source NAT to the proper ISP subnet (clone and change destination interface + source translation)

Inbound NAT will only work for the ISP that routes the public IP so this can only be configured once for the appropriate ISP (so no cloning here)

Re: Dual ISP scenario

soporteseguridad — Thu, 22 Mar 2018 15:48:48 GMT

Thanks reaper. Outbound is ok.

Thinking in inboud:

We have these NAT rules:

ISP1 is 1.1.1.1:

So, there is any way to clone all these NAT rules changing ISP 2.2.2.2, and if ISP 1.1.1.1 goes down, the inbound sessions take ISP 2???? any NAT track or way to configure public services with both ISPs?

Re: Dual ISP scenario

soporteseguridad — Thu, 22 Mar 2018 15:03:37 GMT

Forget inbound, we would have DNS problem, and create abother zone for ISP2.......to many config fo this end customer.....

thanks a lot reaper

Re: Dual ISP scenario

OtakarKlier — Thu, 22 Mar 2018 15:14:16 GMT

Hello,

The only way to get inbound redirection to work would be to use an external load balancer. That way the LB would know which way is the best path and route to it while the public DNS record points to the LB IP's.

Hope that helps.