I have setup dozens of PANs with multiple ISPs and failover but have some questions in regards to best practices.. 1. Is PBF the only way to handle failover? If not, can the same be achieved via HA Link/path monitoring or is that specifically for device/firewall failover? 2. This is mostly in regards to what is processed first in the firewall. If you setup two ISPs, are there any issues with putting them in the same zone so you can manage them as a single zone from a security perspective? My question mostly revolves around NAT. If you have two NAT policies which match Internal to External but the policies have two different source NAT IPs.. will the firewall look at the PBF table, see which interface it is going to go out of, then apply the appropriate NAT policy? Or do you have to put the ISPs in separate zones?
... View more
