Dual ISP, PBF traffic not returning

Cooper80 — Wed, 12 Feb 2020 16:19:10 GMT

I have two ISPs configured with path monitoring and I can successfully monitor the primary route and fail over to the secondary, however what I would like to do now is use PBF to always send some of my traffic out the secondary ISP. Everything I've read says this is possible and should be fairly straight-forward but I just can't seem to get it to work. I have a test PBF policy set up for all traffic from a single client and the policy appears to be working, hit counts increase and my traffic detail shows that the correct interface and NAT policy is being applied however I don't get any packets back. I've torn down and rebuilt the rules a couple times now so it's possible I've become blind to a simple missed setting.

Again if I simply fail the primary route, the secondary route takes over and all traffic flows out so the interface is working as is the outbound NAT and security policies; my problem just seems to be using both interfaces at the same time.

Re: Dual ISP, PBF traffic not returning

BPry — Wed, 12 Feb 2020 22:54:33 GMT

@Cooper80,

One thing to look at is if you have zone protection enabled and you have the spoofed ip address checked in TCP/IP Drop options under Attack Protection. This in conjunction with PBF will cause the firewall to drop the return traffic as it doesn't align with the route table.

Re: Dual ISP, PBF traffic not returning

LeVietHa — Sun, 13 Jun 2021 14:02:58 GMT

Thank you very much BPry and Cooper80. You save my time!

topic Dual ISP, PBF traffic not returning in General Topics

Dual ISP, PBF traffic not returning

Re: Dual ISP, PBF traffic not returning

Re: Dual ISP, PBF traffic not returning