About mario11584

I followed the documentation in this article but it isn't working for me. A simple traceroute from outside the network shows our traffic is going over our secondary ISP (Integra). I prepended the ASN 4 times for the secondary ISP export rule. I also changed the local preference under import rules to 500 for primary ISP (Veracity). Any ideas where I may have gone wrong? Attached are some screenshots of my configs. ... View more

So, I've turned up BGP with both ISPs. Right now our inbound traffic destined to our advertised /24 is coming in through our secondary ISP. We want it to all come through our primary ISP except in the case of primary ISP failure. I've fiddled around with the import configurations but I haven't been able to figure it out. What's the best way to do this? Also, is it okay to leave our PBF (primary ISP route) and static route (secondary ISP route) rules in place for outbound traffic and just rely on BGP for inbound traffic? Thanks! ... View more

Thanks! That's perfect! ... View more

Missouririver, wow! This is exactly the information I was looking for. Very very informative! Thanks a ton for the diagram and explanation. I do have a couple more questions, however, if you don't mind. First of all, if I don't need a physical interface configured with the /24 subnet, then what is the purpose of having it? Just to advertise it to my peer routers? If that's the case why do I need so many IPs to do that? Second, in regards to creating a static redistribution profile for the static route. Instead of using the type "connect" I would use "static" instead, correct? Do I leave the interface blank since I don't need the /24 configured on a firewall interface? Screenshots of the BGP configuration would help immensely too. Thanks again! ... View more

Unfortunately, I have not. I have mostly given up on it for the time being. We have another firewall that actually supports the Avaya phones (although it's not an ideal setup). I couldn't even get the phone to connect to the VPN. Which method are you trying? GlobalProtect or IPSec tunnels? If you can get the tunnel working but have disconnect issues maybe I'll give it another try and see what we can figure out. ... View more

Thanks a ton for your response. It was extremely helpful. To answer your questions: a) We have two ISPs we want to peer with. b) We have a pair of PA500s. They're both setup with HA and tested and confirmed working. c) Active/Passive configuration d) As of right now we're only going to do default routes (if we decide we need full routing tables down the road we'll use a pair of Cisco 3925e routers) We've been thinking of taking our /24 (the network we'll advertise via BGP) and cutting it down to a /27 and assigning that it's own interface on the PA. That interface will then connect to a newly created VLAN on our core switches where we can plug in other "internet" facing devices that we would like to have highly available using BGP. We also have an interface configured with a subnet we use to route traffic to our core switches. The core switches then have dozens of other VLANs and the network spreads out from there. Will BGP still provide internet redundancy to this (private) network between my two ISPs even though they don't live on the /27 (or /24) or does it have to live on that network or route traffic from it somehow? Here are some screenshots of my partial configuration: ... View more

Thanks for the response. I still don't quite understand. If I use the /24 public IPs I've been assigned, on the external interfaces, how do I from a peer relationship with my ISP's routers, as the /24 IPs don't live on their network. My assumption was that the external interfaces would be configured with the IPs my ISP has given me so each respective interface lives on the ISP's networks, and I would configure an internal interface with the /24. So, traffic destined for my /24 from the internet would be routed via one of the ISPs peer routers (because of the BGP route advertisements) to my firewall, then switched over to the /24 interface configured internally, and translated via NAT and passed on the the local network. Is my assumption wrong? Thanks again. ... View more

Tpiens, thank you for your response. User identification is a good idea, however, we are an all Linux environment and we are having troubles coming up with a solid solution implementing it. We are unable to use captive portal options because there isn't anyway our 300+ users would respond well to having to log in via web form. It seems as if for now, we'll have to postpone using GP until we can figure out user identification. Thanks again! ... View more

I was able to figure out the problem. I believe the issue was related to my NAT policy and routing. My NAT policy was translating traffic to the IP address of the interface used for our primary ISP but routing it out the interface for our secondary ISP. I have ISP failover setup using PBF for the primary ISP and a virtual route for the secondary ISP. The PBF routes traffic from my trust to untrust zones. (There aren't any PBF rules configured with the source zone my VPN is using so the firewall should check the virtual router next.) I have a default route setup on the virtual router that is used in the event the PBF primary ISP route fails. I also had another default route for traffic that should already be routing traffic via the previously mentioned PBF policy, just with a lower priority metric (probably shouldn't even be there). I believe the NAT policy was translating traffic to the primary ISP interface IP address but the virtual route with a higher priority metric was sending that traffic out the secondary ISP interface. I removed the second "default" route and created another PBF policy that routes traffic from my VPN zone to the primary ISP interface. Tested and works great now! I hope this made sense. ... View more

I am running into this problem as well. I have the access route 0.0.0.0/0 configured. I have a security policy to allow traffic from my VPN zone to the untrust zone. I created a NAT policy identical to the one in place for traffic from untrust to trust with the exception being traffic is coming from the VPN zone. See the screen shots below. I only have one virtual router but how do I make sure it is part of the same outside layer 3 interface? NAT Policy: Security Policies: Access Route: ... View more