Paloalto NGFW - Policy-Based Forwarding (PBF) - Enforce Symmetric Return

[atalakeytamkeen]

Hello,

I have two sites: Site 1 and Site 1, both running Palo Alto NGFW. Currently, traffic is routed between the sites via an IPSec VPN tunnel. However, we’ve recently set up MPLS between the sites and are planning to gradually migrate traffic from IPSec to MPLS.

The challenge we're facing is related to asymmetric routing, where requests coming from MPLS are being returned via IPSec. I am attempting to use PBF (Policy-Based Forwarding) to enforce symmetric return, but it's not functioning as expected.

The diagram below outlines the high-level network topology:

I would greatly appreciate any help with this issue.

Thanks!

[TomYoung · Accepted solution]

Hi @atalakeytamkeen ,

I would get rid of PBF and use ECMP.  I have had good success with ECMP and symmetric return.  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/ecmp/configure-ecmp-on-a-virtu...

You can use route metrics to select your preferred path with ECMP.  Routing is more effective and simple vs. PBF IMHO.  Please continue this thread if you need more detail.

Thanks,

Tom

[atalakeytamkeen]

Thanks for your help! The ECMP Symmetric Return worked perfectly and got the job done.

I have another question I hope you can assist with. Site 2 is accessing numerous resources on Site 1, and to avoid adding too many static routes on the virtual router, I’m currently using PBF to group all destination addresses into a single rule. Now that we’re using ECMP, is there a way to manage these routes without adding them one by one in the virtual server static routes? Or can PBF still be used for routing while ECMP handles the Symmetric Return?

Thanks in advance!

[TomYoung]

Hi @atalakeytamkeen ,

"is there a way to manage these routes without adding them one by one in the virtual server static routes?"  You could create summary routes.  For example, if Site2 only has the 1 VPN then you could route RFC1918 traffic (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) over the tunnel and all else would go to the Internet.  You could also create summaries tailored to your specific routes.  ECMP would allow you to load balance the traffic across both circuits if desired.

You could also use a routing protocol.  https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/site-to-site-vpn-quick-c.... With regard to MPLS, configure OSPF on your trust interface.  On Site1, you may need to redistribute static into OSPF.  In the end, dynamic routing is easier, but it takes a while to get used to it.

"Or can PBF still be used for routing while ECMP handles the Symmetric Return?"  PBF still can be used, but in the end routing is more straightforward and easier to troubleshoot.

Thanks,

Tom