Hi @UtkarshKumar ,
This is expected behaviour. Although this is considered "local" traffic (targeting the firewall itself, not passing through). Firewall will still perform policy and route lookup when generating reply for traffic to Data Plane interface.
Why this is happening:
As described in Getting Started: Packet Capture - Knowledge Base - Palo Alto Networks and Building Blocks for a Custom Packet Capture (paloaltonetworks.com) the four stages for the packet captures are:
drop
- When packet processing encounters an error and the packet is dropped.
receive - When the packet is received on the dataplane processor.
transmit - When the packet is transmitted on the dataplane processor
firewall
- When the packet has a session match or a first packet with a session is successfully create
These stages can roughtly map as follow to the flow sequence - Packet Flow Sequence in PAN-OS - Knowledge Base - Palo Alto Networks
receive = ingress stage
firewall = firewall session lookup + session setup + AppID + Content inspection
trasmit = forward/eggress stage
As you can see during firewall stage, firewall perform route lookup to identify the destination/egress interface.
Since the default route for ISP-A is with better metric, only that route is installed in the FIB (forwarding table).
And since the FIB lookup return only ISP-A default route, the reply packet is forwarded through the interface connected to ISP-A
Suggested Solutions:
The simplest solution would be to create static host route for the source IP via ISP-B. This way reply will take the host route (since it is better match then the default route). The disadvantage of this approach is that ping to ISP-A from the same source IP will now fail, because replies will always go via ISP-B
More scalable solutions would require a bit more configuration. Note: I haven't tested, this but I am almost certain that it will work that way
Enable ECMP and create two default routes via ISP-A and -B using same metric. This way both default routes will be installed in the FIB
Enable "Symmetric Return" for the ECMP. This will ensure firewall will reply with the same interface, which has received the original packet
Enabling ECMP however will cause your outbound traffic to be load-balanced between the two ISP, which you don't want. To avoid this you will need PBF (policy based routes) with path monitor, which will make sure that outbound traffic is forwarded via ISP-A and when path monitor is down, traffic will be failovered to ISP-B
... View more
