Need some suggestion about the routing between 2 internet outgoing interfaces

[jeremylo]

I recently submitted a case to PA support about 1 of the internet facing interface cannot contact outside nor contact from outside. Use ping to diagnostic and found that the ping (request) and ping (reply) use 2 different route ).

This is because the 2 interfaces has its own zone and for different purpose:

1. Staff use the 1st data line, and use the 2nd data line if first one down.

2. Guest use only the second data line.

This was achive by NAT and Policy Based Forwarding.

The problematic one is the 2nd interface which has the issue of asymmetric routing.

But I setup only 1 virtual router which the static route of 1st data line has its priority higher. This cause the outgoing always use 1st interface, return from 2nd interface.

PA support suggest I merge the 2 interfaces in to the same zone. But I doubt this may violate to the network design mentioned above.

Is there anyway to force the 2nd interface outgoing and incoming always use the same route?

[LukeBullimore]

What about if you point your default route to your 2nd data line, then do a PBF to force traffic (for staff only if thats what your requirement is) to go out via 1st data line then enable "enforce symmetric return" option?

On the PBF rule you would then enable monitoring so if the gateway for the 1st data line is unreachable the failover to the 2nd data line works by going out via the default route after the PBF rule is disabled as per option "Disable this rule if nexthop/monitor is unreachable"

Cheers,

Luke.

[jeremylo]

hello LukeBullimore,

If I set the 2nd data line to higher priority. Will the same problem happen on the 1st data line?

In my current settings, user subnet can use the 2nd data line to reach internet. Only the interface cannot. I want to use this interface for send alert email and get PAN-OS update.

1st data line has no service route need. But I still hope it can be ping.