PBF for Guest Network

jocisneros_coe — Wed, 03 Mar 2021 21:00:29 GMT

Hello, I'm trying to route all GUEST traffic on a PA firewall to ISP-2. I understand you can use PBF on the PA firewall to route based on source address. I don't have a lot of experience with PBF and have encountered a few issues when trying to implement this.

Some questions I have

1). Do I need a 2nd VR to do this?

2). Do I need 2 new security zones (one for the outside of the guest ISP and inside to the guest network)

3). If I add a 2nd NAT policy for the GUEST Public IP, will it affect my current production NAT?

Re: PBF for Guest Network

reaper — Thu, 04 Mar 2021 08:58:37 GMT

Hi @jocisneros_coe

for PBF you don't need a second VR since PBF bypasses routing

you only need to add a zone to the second ISP interface

set your NAT rules with a destination interface, that way NAT will be applied depending which interface packets are going to leave towards the internet

the additional VR, and 2 zones approach is actually \better than using PBF, as that segregates your guest network from your production network

topic Re: PBF for Guest Network in General Topics

PBF for Guest Network

Re: PBF for Guest Network