topic Re: Destination NAT is not working when PBF for dual ISP is enabled in General Topics

Destination NAT is not working when PBF for dual ISP is enabled

BoonKeatGan — Mon, 25 Jun 2018 03:05:57 GMT

Hi All,

I followed the guide at this URL to setup the Dual ISP for outbound access.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/use-case-pbf-for-outbound-access-with-dual-isps

I have set the http/https services to use ISP 2 and other traffic to use ISP 1. It is working find and the redundancy also working fine.

However, I have 2 web services that hosting using ISP 1. I have setup the destination NAT and required policy but it is not working when the 2 ISP link is up. If i disconnect the ISP 2, the destination NAT is working fine.

I also tried to setup the PBF rule for Symmetric Return using ISP 1 using the following guide.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Symmetric-Return/ta-p/59374

The log details when the Dual ISP + Symmetric PBF is define. It just showed incomplete and aged-out. From Client wireshark, it keep resending the TCP transmission.

The result when disable the PBF for Symmetric returna and disconnect ISP 2.

Is there any other thing I need to do in order to allow dual ISP and destination NAT to work? Appreciate if someone can give me a hint on this.

Re: Destination NAT is not working when PBF for dual ISP is enabled

pulukas — Mon, 25 Jun 2018 23:31:07 GMT

I think you will need to modify your PBF filter rule for the web server to work. What might be happening is the http/https traffic from the server in reply to the inbound dNAT is being picked up and sent to ISP 2.

Add to that filter a negate ip address source for the internal address of your web server so that it is not covered by the forwarding filter.

Re: Destination NAT is not working when PBF for dual ISP is enabled

BoonKeatGan — Tue, 26 Jun 2018 00:53:08 GMT

I figure out the problem.

When i added the PBR for this destination NAT, i did not specific the next hope. The Interface and Server VLAN are different. That why.