topic Re: AWS x PAN 2 tunnels PBF backhaul internet static routes? in General Topics

AWS x PAN 2 tunnels PBF backhaul internet static routes?

drewdown — Wed, 31 Mar 2021 20:26:07 GMT

Anyone run into this before? I have 2 x AWS tunnels (No BGP) and I want failover to occur and I want to backhaul internet traffic from AWS out through the PAN. I have connectivity between AWS and on-prem with no static routes configured. However, if I try to backhaul internet traffic from AWS across the s2s vpn tunnel (attached to TGW) it fails. The only way I can get it to work is by adding a static route back to the AWS subnets in my VR. But in doing so that won't allow the traffic to failover via PBF as far as I know. Is that right and if not can someone explain how the correct way to make this work?

Note I use PBF for dual ISP failover to the internet and am wondering if its in the same vein? IE a static route to the backup path and PBF for the primary? So what I am wondering do I need static routes configured in my VR? And if I do does PBF still trump the routing table?

Re: AWS x PAN 2 tunnels PBF backhaul internet static routes?

reaper — Thu, 01 Apr 2021 12:11:11 GMT

pbf takes precedence over the routing table of the firewall, but it will not override any routes you added to the VPC

could you include a little drawing or some more info of what you're trying to accomplish ?

Re: AWS x PAN 2 tunnels PBF backhaul internet static routes?

drewdown — Thu, 01 Apr 2021 13:38:52 GMT

Ok so even if I have static routes for the AWS subnets pointing to tunnel-A and PBF failing over to tunnel-B it should work? Basically I want all traffic to traverse tunnel-A and when that goes down switch over to tunnel-B. Not worried about the AWS side, just the right configuration on the PAN side.

Re: AWS x PAN 2 tunnels PBF backhaul internet static routes?

drewdown — Thu, 01 Apr 2021 13:39:14 GMT

Re: AWS x PAN 2 tunnels PBF backhaul internet static routes?

OtakarKlier — Thu, 01 Apr 2021 20:54:26 GMT

Hello,

There are several ways to do this. I chose to use PBF and put the tunnels in over. Even PBF reads top to bottom so the first one that is a match, thats where it sends traffic. Also make sure to enable the monitor so the policy is disabled if the tunnel is down, etc.

So for me it was two policies base forwarding policies. The other way would be one PBF and the second a static route down the second tunnel.

Hope that helps.

Re: AWS x PAN 2 tunnels PBF backhaul internet static routes?

reaper — Thu, 01 Apr 2021 22:26:47 GMT

correct, but make sure to set a monitor as @OtakarKlier mentioned so the PBF rule can be disabled if the monitor fails, else you will keep hitting the PBF even if it's "broken"

Re: AWS x PAN 2 tunnels PBF backhaul internet static routes?

drewdown — Fri, 16 Jul 2021 17:01:54 GMT

Are you running TM on the IPSec Tunnels themselves as well on the PBF rules? I was just doing it on the PBF rules but added them to the actual tunnel interfaces as well. Hoping that will solve my problem of having to manually restart both tunnels when one goes down and all traffic stops passing. I have no STATIC routes for any of the CIDRs on the other ends of both tunnels, can anyone tell me if this is right?

IPSec Tunnel:

PBF: