PBFand Default route

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

PBFand Default route

L1 Bithead

In our orginazation, we have dual ISP and PAN firewalls. We have configured PBF with ISP 1 and default route for ISP 2

 

Both ISP interfaces on Pan firewall is same zone called untrust

 

example :  ethernet 1/11 

                     ethernet 1/11.200 ----- 192.168.1.1/30  - untrust

                     ethernet 1/11.250 ------172.16.10.1/30 - untrust 

 

When primary ISP goes down, the traffic is not taking default route. if we configure another zone like untrust1 to second ISP 

 when the PBF fails, traffic will take default route, Is something we need configure here if the both the ISP's are in same zone 

 

 

 

 

3 REPLIES 3

Cyber Elite
Cyber Elite

outbound traffic may be hitting an incorrect NAT rule as the zones are identical, what is the output of "show session id <id>" of a failing session the moment the default route should be used? is the egress interface correct, is the source NAT accurate,...

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L4 Transporter

In PBF have you configured monitoring option ( like 8.8.8.8) this wll give info to firewall that ISP 1 is down use routing table

PCNSE-7, ACE-6,ACE 7 , CCNP, CCNA,CCIE(theory) , RHCE
Firewalldog dot com

Yes as per Roby's comment you need the monitor or PAN will still execute the PBF policy as it does not know your ISP 1 is down.

 

You could easily test this by putting in a single (test) source IP in the PBF and set a monitor which does not respond, then do a traceroute from the source IP. You should see the route go via ISP2.

  • 2295 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!