Hello. I have a specific question about certain situation. There is a customer with 2 ISPs, let's call them ISP1 and ISP2. Customer has a single PA device to which both ISPs are connected. Each ISP provides a block of public IP addresses which are routed to the PA device. With PBF we'll make a rule, which sets ISP1 as primary ISP and ISP2 as secondary. So default route will be set to ISP1 when ISP1 is up and to ISP2 when ISP1 is down. So far it's all pretty standard situation. Now let's say teh customer has some server in its DMZ zone. Server has a local IP address in DMZ zone so NAT is needed. Customer wants the server to be available on BOTH ISPs all the time, Therefore we make 2 NAT rules; one for each ISP. Let's say ISP1 is active at certain moment so default route is pointing towards ISP1. But someone tries accessing server over ISP2. In that case packet comes from ISP2, gets translated to private IP address, enters DMZ zone, server replies, packet reaches PA device again and now the PA device has to put packet on proper interface. In this case; will PA put packet on ISP1 interface where default route is pointing, or will it know that packet originated from ISP2 and will correctly put it on ISP2 interface? Ok, I know this sitation can be avoided with proper use of DNS records or BGP, but it's a temporary solution so I'm really interested what PA will do in exactly such situation.
... View more
