PA with Two ISPs NAT

[ParvezAhmad]

Dears,

We have four zone in the PA. The naming along with subnet are below mentioned.

1. ISP1- 100.100.100.2/29

2. ISP2- 200.200.200.2/29

3. DMZ1- 172.16.1.1/24

4. DMZ2-172.10.1.1/24

5. Inside- 10.10.10.0/24

Inside user are going to internet via ISP1 and ISP2 is used for accessing in the DMZ1 and DMZ2.

Since the default route is configured towards the ISP1. We are facing the issue to access the servers in DMZ1 and DMZ2 via ISP2.(Destination Nat is configured for these servers via ISP2).

As per the logs the session from ISP2 to DMZ1 and ISP2 to DMZ2 are showing incomplete.I tried to configure PBF but it is not working.

Kindly let me know how DMZ1 and DMZ2 servers can accessible via ISP2.

Best Regards,

[HULK · Accepted solution]

Hello Parvez,

Here's a good document with a network diagram which can help. Symmetric return eature forwards the packet to the MAC address from where the SYN or lost packet was received.  This ensures return traffic follows the same interface which the session created and is useful in an asymmetric routing or Dual ISP environments.

How to Configure Symmetric Return

Hope this helps.

Thanks

[panos]

also when wan interface's are ppoe you don't need to write next hop, just selecting enforce return works.

[ParvezAhmad]

I just want to double check that it will work for another DMZ2 host ; that is also need to be accessed via ISP2.

i.e. is PA-FW support two PBF on the same interface (ISP2) with different zone hosts(DMZ1 and DMZ2)?

[HULK]

Hello Parvez,

Yes, it will work.

Thanks