Route specific traffic out backup ISP?

[drewdown]

We have dual ISP (ISP-A and ISP-B) and utilizting PBR which works just fine.  Now I have use case whereas I have a NAT configured on ISP-B (1 to 1) and I want to force traffic to a specific destination out the backup interface.  I want to do this to ensure traffic destined for a specific address IP-B is sent out the backup interface.  I tried adding a specific route on the VR with the interface and next hop as ISP-B but the path from behind the PAN still takes the primary interface and hop.  

I am missing something but not sure what?  

[drewdown]

The 1 to 1 NAT in question is at the top of the list, followed by the dynamic NAT statements for ISP-A and ISP-B. 

Is there a command I can run to see if a NAT is being applied to certain traffic based on source IP?  

[BPry]

@drewdown,

Within the CLI you can run 'test nat-policy-match' and build out the complete traffic match and it'll tell you the exact NAT policy that the traffic will match. 

[drewdown]

Thanks...it shows its applying the NAT from the source and destination IP I created the NAT for.  Still don't understand why the provider would tell me they are seeing .37 vs .38 NAT'd IP.  

test nat-policy-match source 192.168.25.33 destination 125.17.100.5 protocol 1

Source-NAT: Rule matched: NAT-provider-1to1
192.168.25.33:0 => 111.44.44.38:0 (1), ethernet1/3

-------------------------------------------------------------------------------

[BPry]

@drewdown,

I would attempt to contact the provider and have them verify the source-address they are getting on their end again, maybe they just typo'd. I've never had nat-policy-match lie to me unless I entered something in wrong, but maybe? You can also verify within your own logs what NAT address was actually applied to the traffic, so verify that the address is being recorded correctly and that the logs aren't also indicating the wrong NAT IP. 

[drewdown]

So its fixed.  It looks like the PAN was holding onto the old sessions before the NAT?  Once I cleared them it started using the NAT IP and the connection started to work.  Does PA not kill sessions after x amount of time?

\UNfrotunately I didn't do a show prior to clearing them...

admin@fw-PAN(active)> show session all filter source 192.168.25.33

--------------------------------------------------------------------------------
ID          Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port])
Vsys                                          Dst[Dport]/Zone (translated IP[Port])
--------------------------------------------------------------------------------
124573       ipsec-esp-udp  ACTIVE  FLOW  NS   192.168.25.33[4505]/trust/17  (111.44.44.38[4505])
vsys1                                          125.17.100.5[4500]/untrust  (125.17.100.5[4500])
114885       ipsec-esp-udp  ACTIVE  FLOW  NS   192.168.25.33[4505]/trust/17  (111.44.44.38[4505])
vsys1                                          14.140.164.65[4500]/untrust  (14.140.164.65[4500]

Thanks for all your help dudes.