PBF vs Static Route

[rsaber]

Hi,

I have traffic going from A.A.A.A to B.B.B.B,

The problem this is working with the static route. But I need to use PBF instead for monitoring reasons. When removing the Static route and using PBF traffic is not reaching the target. I am configuring as follows:

For PBF: If the source is A.A.A.A send the traffic to M.M.M.M

For Static route: If the destination is B.B.B.B send the traffic to M.M.M.M

[panos]

Hi,

is A.A.A.A an interface ip of your Firewall ?

[HULK]

Just keep in mind as PBF decision would be taken by PBF "RULE" configured on the PA firewall, not by routing. So PBF rule can replace the routing as  it is not session based. Please make sure incoming/outgoing traffic passing through the same  link. It will help you to avoid asymmetric-routing.

For reference :- Policy Based Forwarding

Thanks

[rsaber]

No A.A.A.A is not an interface on the firewall.

[panos]

Look at these first

Testing Security, NAT and PBF Rules via the CLI

Where is Policy Based Forwarding (PBF) Monitoring Traffic Sourced From?

PBF Rule does not match traffic to or from the firewall directly

Inbound NAT Policy with Outbound PBF Causing IP-Spoofing Drops

[VinceM]

Hi,

PBF should look like:

If traffic come from AAA and go to BBBB then send to GGGG (your gateway for going to BBBB)

if traffic come from any and go to any then send to HHHH (other gateway on your network)

No need for default static route.

V.