PBF for Guest Network

[jocisneros_coe]

Hello, I'm trying to route all GUEST traffic on a PA firewall to ISP-2. I understand you can use PBF on the PA firewall to route based on source address. I don't have a lot of experience with PBF and have encountered a few issues when trying to implement this. 

Some questions I have

1). Do I need a 2nd VR to do this? 

2). Do I need 2 new security zones (one for the outside of the guest ISP and inside to the guest network)

3). If I add a 2nd NAT policy for the GUEST Public IP, will it affect my current production NAT? 

[reaper]

Hi @jocisneros_coe 

for PBF you don't need a second VR since PBF bypasses routing

you only need to add a zone to the second ISP interface

set your NAT rules with a destination interface, that way NAT will be applied depending which interface packets are going to leave towards the internet

the additional VR, and 2 zones approach is actually \better than using PBF, as that segregates your guest network from your production network