Policy Based Forwarding PBF based on destination country or self defined region?

[bspilde]

Can this be accomplished without something like a Performance Routing service or hybrid WAN systems a couple companies offer? Is it a roadmap feature of PAN-OS PBF? PBF seems to be one of few things that do NOT support Regions.

I'd like to PBF my connections to Country A through a different path than directly out my Country B firewall to achieve lower latency connections on MPLS. I'm trying to have fewer devices in my network vs adding more.

[bat]

Hi bspilde

I don't think it is currently possible to achieve this. There is a feature request for this :

FR ID: 1497

You can get in touch with your SE to vote for the above feature request.

Hope it helps !

[bspilde]

Here is a quote from the Help Guide on PAN-OS 6.1 in the PBF section that clearly specifies that Regions is an option for the Destination:

Destination/Application/Service Tab

Use the Destination/Application/Service tab to define the destination settings that will applied to traffic that matches the forwarding rule.

Field	Description
Destination Address	Click Add to add destination addresses, address groups, or regions (default is any). Select from the drop-down list, or click the Address,Address Group, :smileyshocked:or Regions:smileyshocked: link at the bottom of the drop-down list, and specify the settings.

Full Section::smileyshocked:

Policy-Based Forwarding Policies

Policies > Policy Based Forwarding

Normally, when traffic enters the firewall, the ingress interface virtual router dictates the route that determines the outgoing interface and destination security zone based on destination IP address. With policy-based forwarding (PBF), you can specify other information to determine the outgoing interface, including source zone, source address, source user, destination address, destination application, and destination service. The initial session on a given destination IP address and port that is associated with an application will not match an application-specific rule and will be forwarded according to subsequent PBF rules (that do not specify an application) or the virtual router’s forwarding table. All subsequent sessions on that destination IP address and port for the same application will match an application-specific rule. To ensure forwarding through PBF rules, application-specific rules are not recommended.

When necessary, PBF rules can be used to force traffic through an additional virtual system using the Forward-to-VSYS forwarding action. In this case, it is necessary to define an additional PBF rule that will forward the packet from the destination virtual system out through a particular egress interface on the firewall.

For configuration guidelines and information on other policy types, refer to “Policies and Security Profiles”.

For information on defining policies on Panorama, see “Defining Policies on Panorama”.

The following tables describe the policy-based forwarding settings:

•	“General Tab”

•	“Source Tab”

•	“Destination/Application/Service Tab”

•	“Forwarding Tab”

General Tab

Use the General tab to configure a name and description for the PBF policy. A tag can also be config....

Field	Description
Name	Enter a name to identify the rule (up to 31 characters). The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores. Only the name is required.
Description	Enter a description for the policy (up to 255 characters).
Tag	If you need to tag the policy, click Add to specify the tag. A policy tag is a keyword or phrase that allows you to sort or filter policies. This is useful when ...

Source Tab

Use the Source tab to define the source zone or source address that defines the incoming source traffic to which the forwarding policy will be applied

Field	Description
Source Zone	To choose source zones (default is any), click Add and select from the drop-down list. To define new zones, refer to “Defining Security Zones”. Multiple zones can be used to simplify management. For example, if you have three different internal... Note: Only Layer 3 type zones are supported for policy-based forwarding.
Source Address	Click Add to add source addresses, address groups, or regions (default is any). Select from the drop-down list, or click the Address, Address Group, or Regions link at the bottom of the drop-down list, and specify the settings.
Source User	Click Add to choose the source users or groups of users subject to the policy. The following source user types are supported: • any—Include any traffic regardless of user data. • pre-logon—Include remote users that are connected to the network using GlobalProtect, but are not logged into their system. When the Pre-logon option is configured on the Portal for GlobalProtect clients, any user who is not currently logged into their machine will be identified with the username pre-logon. You can then create policies for pre-logon users and although the user is not logged in directly, their machines are authenticated on the domain as if they were fully logged in. • known-user—Includes all authenticated users, which means any IP with user data mapped. This option is equivalent to the “domain users” group on a domain. • unknown—Includes all unauthenticated users, which means IP addresses that are not mapped to a user. For example, you could use unknown for guest level access to something because they will have an IP on your network, but will not be authenticated to the domain and will not have IP to user mapping information on the firewall. • Select—Includes selected users as determined by the selection in this window. For example, you may want to add one user, a list of individuals, some groups, or manually add users. Note: If you are using a RADIUS server and not the User-ID Agent, the list of users is not displayed, and ...

Destination/Application/Service Tab

Use the Destination/Application/Service tab to define the destination settings that will applied to traffic that matches the forwarding rule.

Field	Description
Destination Address	Click Add to add destination addresses, address groups, or regions (default is any). Select from the drop-down list, or click the Address,Address Group, or Regions link at the bottom of the drop-down list, and specify the settings.

[hshah]

Hi Bspilde,

Its correct, regions are not supported in PBF rules. Kindly follow FR ID: 1497.

I can see "Region" as source or destination in configuration guide. But it would be just a typo or error. Kindly ignore it.

Regards,

Hardik Shah

[NathanHughes]

A better question would be, why CAN'T PBF be formed around destination region.  It would be useful to be able to route some internet destinations one way, and others another way.

It seems to me it would be minimally difficult for the Palo Team to permit this, since they already have RBLs full of regional addressing by country anyway.