In our orginazation, we have dual ISP and PAN firewalls. We have configured PBF with ISP 1 and default route for ISP 2
Both ISP interfaces on Pan firewall is same zone called untrust
example : ethernet 1/11
ethernet 1/11.200 ----- 192.168.1.1/30 - untrust
ethernet 1/11.250 ------172.16.10.1/30 - untrust
When primary ISP goes down, the traffic is not taking default route. if we configure another zone like untrust1 to second ISP
when the PBF fails, traffic will take default route, Is something we need configure here if the both the ISP's are in same zone
Yes as per Roby's comment you need the monitor or PAN will still execute the PBF policy as it does not know your ISP 1 is down.
You could easily test this by putting in a single (test) source IP in the PBF and set a monitor which does not respond, then do a traceroute from the source IP. You should see the route go via ISP2.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!