Secondry ISP not able to ping form external.

[m.habib424169]

 I have two ISP connected to my firewall.
1. ISP1 is in untrust zone and default route configured metric value is 10.
2. ISP 2 is in WAN1 zone and default route metric value is 15.
3. Both ISP are in same virtual router.

I am facing one issue i cannot ping my ISP2 from external.

My home public ip if i enter  static route in the palo alto firewall in virtual router point to ISP2 interface then only from my home i am able to ping ISP2.

Configuretion i made in my PA.

1.policy:  WAN1 to WAN1 all allowed any any 

2. PBF:  configured (Source WAN1 source any) (Destinaiton address any) forward to ISP2 interface and enabled the  Enforce Symmetric Return

3. NAT: Source WAN1 Destination WAN1 Destination Interface ISP2 interface source any destination any translated to Dynamic IP And Port to ISP 2 interface. 

Dear Expert Please help me to solve my issue?

[SutareMayur]

Hi @m.habib424169 

While configuring the PBF, select source type as Interface because the symmetric return is based on the incoming/outgoing interfaces then check.

Keep us posted with the status.

Hope it helps!

[m.habib424169]

Yes i also treid method before but still cannot. Please help.

I am slo thinking that my PBF is worng. 

[CosminM]

Hello @m.habib424169 

Your PBF rule should be with action No PBF and enabled Enforce Symmetric Return.

Also, I don't see the meaning of your NAT rule. If you don't disable that NAT rule when you will ping from external your ISP2 interface it will result into a LAND attack and the packet will be silently drop.

[Raido_Rattameister]

Are you pinging from the firewall towards ISP?

PBF policies do not apply to traffic sourcing from the firewall.

PBF policies apply only to traffic passing through the firewall.

If you want to send traffic from inside out towards ISP 2 then source zone in PBF policy needs to be INSIDE not WAN1.

[m.habib424169]

I want to ping from external. Actually i want to enable SSLVPN for this interface. 

My source is WAN (outside Any public ip) network. 

Please advise what configuration i do?

[CosminM]

Then you need to configure ECMP on your virtual router and enable symmetric return.

More details can be found https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/ecmp/configure-ecmp-on-a-virtu... 

[Raido_Rattameister]

With ECMP and symmetric return also don't forget to set default route metric to the same (currently 10 and 15).

[m.habib424169]

ECMP in the virtual router can help resolve the issue by allowing the firewall to use both ISP1 and ISP2 simultaneously for outbound traffic. But in my case ISP1 is primary and ISP2 is secondary. And both interfaces are different Zone.

ISP1 is used for internet treffic
ISP2 i want to USE for IPSEC tunnels and SSLVPN treffic.