Forwarding streaming traffic to a second Palo

[Jordan_Roebuck]

Hi all. We have two Palo 3020s, each connected to a different ISP. At the moment the 1st firewall handles all our LAN internet based traffic, whereas the second firewall is mainly used for our VPN connections. We're looking at forwarding streaming traffic from the 1st firewall to the second firewall, to reduce the bandwidth usage on our primary ISP connection. I've been looking into configuring Policy Based Forwarding to achieve this, but most examples I see of this only use one firewall connected to multiple ISP connections. We're unable to connect our first firewall to the secondary ISP connection. Looking for advice on how I can forward this traffic through a seconadry Palo.

[TranceforLife]

Hi,

Are these firewall on the same LAN but got two different ISPs connections? What is the default gateway for your LAN clients?

Thx,

Myky

[Jordan_Roebuck]

Both firewalls are on the same LAN, the default gateway of the LAN clients is the first firewall. Thanks.

[TranceforLife]

Hi,

Thanks for the confirmation. Havent done much  of PBF but l think you can specify in the policy for the specific traffic to be fowarded to the 2nd firewall,  then that firewall will use its ISP connection to get out.

Second option would be to have a router/Layer 3 device as DG and do PBF there so it will deside which traffic to send where (1st or 2nd FW)

Thx,

Myky

[reaper]

PBF will work just fine if you consider for each firewall the 'other firewall' is an ISP instead of 'your firewall'

eg. on firewall 1 you'd need to set up pbf routing as if firewall 2 is the second ISP

could you include your topology, this may help get the creative juices flowing also 😉

[Jordan_Roebuck]

See below for a crude diagram of the topolgy

As a test I configured policy based forwarding on P1 with source as the inside traffic (1/2) with 1/6 as the egress interface and 192.168.255.254 as the next hop, I also enforced symetric return. This doesn't work as the traffic still leaves 1/1 (ISP1) on the first Palo.

[TranceforLife]

Hi,

Thx for the diagramm. Did you try to allow any traffic? Just test with any as a destination.  Can you post screen shots of the PBF?

Myky