Policy forwarding question.

Reply
roadracer96
L1 Bithead

Policy forwarding question.

An over-simplified explanation of my setup.  Trust me, it just has to be this way.  :smileywink:

ethernet1/1 - Internet 1.2.3.1/24

ethernet1/2 - LAN 10.10.10.1/24

Nat/dnat/1-1 nat between ethernet 1/1 and 1/2

I have a traffic shaping appliance that I need to loop data through BEFORE NAT on the palo.

Trust me when I say I just cant stick it between the lan and palo.  In a nutshell, I have multiple virtual systems that all need to be looped through the shaper in a complex network.  Only data destined for the internet should go through the traffic shaper.

I WANT to do this:

ethernet1/1 - Internet 1.2.3.1/24

ethernet1/2 - LAN 10.10.10.1/24

ethernet1/3 - 10.0.0.1/30 Shaper Internal side, in LAN zone

ethernet1/4 - 10.0.0.2/30 Shaper External side in LAN zone

The shaper is transparent.  It would be the same as ethernet1/3 and 1/4 being patched together.

Policy forwarding.

Anything outbound to internet from lan zone, next hop 10.0.0.2 egress interface ethernet 1/3

Anything coming in from internet zone to lan, next hop 10.0.0.1 egress interface ethernet 1/4

I tried this once with to virtual routers in the vsys and routing between them.  It didnt work as I expected.  I stopped there and figured I would ask if im barking up the wrong tree and it just isnt going to work.

Input welcome!  Thanks!


Accepted Solutions
roadracer96
L1 Bithead

I think I figured what I was doing wrong.  I think the policy was matching on return from the packet shaper and being sent through it again until TTL expired. 

View solution in original post


All Replies
roadracer96
L1 Bithead

I think I figured what I was doing wrong.  I think the policy was matching on return from the packet shaper and being sent through it again until TTL expired. 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!