Help setting up a return route

Announcements
Attention: The LIVEcommunity is experiencing an interruption with videos in some areas. We apologize for any inconvenience this may cause. Thank you for your patience as we work towards a solution to restore videos.
Reply
Highlighted
Not applicable

Help setting up a return route

Hi,

I am in the process of migrating internet connections, at the moment we have a PA-500 with 3 active internet connections, traffic is routed between different connections using policy routing. This is fine for outbound traffic, however inbound does not work as the traffic attempts to return via the default gateway.

There seems to be no implementation of Reverse Path Forwarding (RPF) to return the traffic for the origin interface.

I need to know if there is a way to set this up. The problem at hand is our mail and webmail is coming in on the "eth0/1" interface which will soon be decommisioned, however during the interum (DNS propergation) we need to have both eth0/1 and eth0/3 accepting traffic for https, smtp, and smtps simaltaniously with the default route going via eth0/3.

I have attempted to try and return the traffic via PBF with no success.

My goal is:

Default Route - eth0/3

Incoming traffic on eth0/1 goes to internal network, then returns via eth0/1, NOT eth0/3

Please help before I loose all my hair :smileyhappy:

Dean.

Tags (3)
Highlighted
L3 Networker

Re: Help setting up a return route

Source nat traffic coming in via eth0/1, that way it will be routed back to the correct interface. That is at least one way of solving it.

Highlighted
Not applicable

Re: Help setting up a return route

Can you give me an example of how I would do this? I have configured "dynamic ip and port" to the next hop with no dice.

Highlighted
L3 Networker

Re: Help setting up a return route

My idea was this:

1. Source NAT (And destination nat) traffic coming in on ethernet0/1. Let's say:

Original SRC packet: 195.1.1.1

Original DST packet: 210.1.1.1

NAT SRC packet: 192.168.1.1

NAT DST packet:10.1.1.1

2. Keep your default route pointing to ethernet0/3

The idea beeing the 192.168.1.1 source address will be the new source of the packet and should be routed back to the correct interface (ethernet0/1) simply because it is a connected route. No need for PBF for this traffic.

I have never tried this in a Palo box (but a similar config in a Juniper/Netscreen worked).

Let me know how it works!

Highlighted
Not applicable

Re: Help setting up a return route

Do you have solved this problem? I have a similar situation in PAN 4.0.1. Why PAN don't have RPF for NAT traffic?

Highlighted
L0 Member

Re: Help setting up a return route

Exactly the same problem here.

Does anyone know if there is way around it using Source NAT rules? I've tried, but no luck so far...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!