Policy Based Forwarding is not working for Secondary ISP

[Anees10]

 

We recently added a new Internet link to our PA-3020. We want only one server (10.1.12.130) to use it, so we configured the new internet link interface as layer-3 , assigned it a static IP, created a PBF policy that basically specifies the zone (internal) and the source IP (10.1.12.130) and the destination is any (negate 10.0.0.0/8) and the action is to forward traffic to egress IF 1/10 with next hop of 1.1.1.1

We also created a NAT rule : From internal zone to external zone, source IF 1/10 and source translation is dynamic-ip-and-port.

Finally, we created a security policy to allow traffic from that source to the internet.

We have one virtual route for the old ISP. It's my understanding that no VR is required when using PBF as no failover or redundancy is required between the two links.

The source server doesn't have internet connectivity. FW's Software Version is 9.1.14-h4. We don't use Panorama to manage it.

I found a similar KB for reference : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRzCAK#:~:text=Policy%20b...

I spent countless hours with PA engineers and they confirmed that the setup looks good, but for some reason they couldn't figure out why this setup is not working.

any thoughts? Thanks in advance.

[rmfalconer]

Does the traffic from the single server egress out ISP 1 even with the PBF in place? 

Do the logs show anything interesting with rule hits, allow/deny, etc?

Any packet captures on any interfaces to track where the traffic is going?

[Anees10]

Thanks for your reply. 

1. The single server doesn't have internet connectivity. It can still talk to the other servers on the LAN but it doesn't have internet connectivity.

2. Captures show that ARP requests are incomplete. This could be due to the fact that there is no VR configured for ISP2.

>show arp all
ethernet1/10 147.129.178.129 (incomplete) ethernet1/10 i 1

>show counter global filter packet-filter yes delta yes severity drop
flow_fwd_l3_noarp 7 0 drop flow forward Packets dropped: no ARP