NAT or policy based routing in multiple ISP case

[migration]

Hi,

I have a three internet access from different ISP. So I have 3 untrust(ethernet1/1, ethernet1/2, ethernet1/3)   interface and on trust(ethernet1/4) interface. All of  them are in same virtual router. The default route will be on  ethernet1/1 interface (0.0.0.0/0 -> default gateway of ethernet 1/1)

I would like to use ethernet1/1 interface for some of internal IPs called X, so I made a source NAT. All traffic coming from these IP group will be use ethernet1/1 for internet access.(trust -> untrust,  from X  to any  -> source nat on ethernet1/1)

The rest of the internal IPs will go to internet from ethernet1/2. To achive this which method is more suitable. NAT or PBF?

I would like to forward the traffic to ethernet1/3 to access my internal server on a remote branch office.

I am planning to write a PBF for this route. If I write a PBF, do I have to create a NAT rule too? or does PBF also handle NAT functionality?

Finally, Do I have to create additional route then default route in virtual router ?

Thanks.

[kbrazil]

Hi Ismail,

I believe you are on the right track with the PBF and NAT.  PBF does not take care of NAT so you will have to do that separately.  The final configuration will depend on how you want the ISP redundancy to work (if any).  In any case you will have a combination of default route, PBF rules, and NAT rules.

Cheers,

Kelly

[migration]

Thanks for your feedback.

[migration]

Hi Kelly,

You said that "PBF does not take care of NAT so you will have to do that separately"

But I have some doubts about this issue. Let me explain with an example.

Let's that I have to ISP connection. If I want to forward only all youtube requests to second ISP via ethernet1/3.

The rest of the traffic will go over first ISP. I can write a PBF rule for youtube. Because PBF support rule for applications.

But, how can I write a NAT for only youtube application? There is no way to specify application in NAT rules.

If I create a service based NAT rule, It can be only HTTP service, In this case all HTTP traffic will go over second ISP?

I guess, PBF does not require extra NAT rules?

Thanks.

[jpa · Accepted solution]

Ismail

You can write the NAT rule to match the destination interface- i..e any traffic going out via e1/3 which in your case is the youtube traffic.

That will be one way to tie the NAT rule with PBF rule.

Thank you

jerish