2 isp 2vr asymmetric

[panos]

Hi,

2VR 2isp,2 seperate default GW (2 ppoe modems)

PC A ---- internet through ISP 1

we want to RDP TO ISP2's public ip and make destination NAT to PC A

How can we make this work ?

New enforce symmetric return did not work .commit fails with ppoe is not supported error.

[dburns]

*Network topology may change this method

If you can burn another port, put an L3 interface in VR2 on the same subnet as PC-A (or what ever subnet other trust interface is on). In the DST NAT rule create a SRC NAT also for the IP of the new L3 interface. Return traffic will come back there and route out VR2.

Thanks,

Dominic

[panos]

there is only 1 interface for VR2

also there is route for pc A's subnet on VR2

Thanks for advice.

[panos]

eth1/1 vr1  2.2.2.2 adsl1  dgw 2.2.2.1  WAN1

eth1/2  vr2  3.3.3.3 adsl2  dgw 3.3.3.1  WAN2

eth1/3 LAN 192.168.2.1  vr1

pca 192.168.2.10

pbf 192.168.2.0 route eth1/1 to  2.2.2.1

3.3.3.3 RDP TO PC A

rule

WAN2  WAN2 3.3.3.1/3389  Dest.nat 192.168.2.10/3389

so using eth1/4 vr2 192.168.2.2

wan2 wan2 3.3.3.1/3389  sourcenat interface eth 1/4  dest. 192.168.2.10/3389

is that what you mean ?

[dburns]

Yes, if you SNAT ETH1/4 it return traffic will never hit VR1 and there for route back out ISP2.

Dominic

[panos · Accepted solution]

I found the solution.

Just a pbf for PC A to route for the service used in NAT to VR2's Default gw to ISP2

thanks for your help.