With complementary PBFs on both sides, will the PBF "Enforce Symmetric Return" feature ensure that I won't face an issue where traffic on one PAN and interface will try to be returned from the other unit on a different interface or tunnel? This should work as you outline. And if it does not, this won't be critical because you have placed the three paths into the same zone on the firewall. So even if the traffic is asymmetrical the session will still match and the traffic will be accepted. Since PBFs operate from top to bottom precidence, will the secondary rule sit idle until the L2 rule above it is disabled? This will work, I would prefer to call it "not hit" as opposed to "idle" but that is just symantics. The idea is the same the rule order is what is dictating the path. Will the wait-recover delays (currently set at the default Interval 3 and HB 5) cause inconsistent behavior on both sides which and lead to potential symmetric return issues? Very likely, the chances of the recoveries being identical is small. But as noted above your zone setup protects the traffic in any case even when not symmetrical. Should the tertiary IPSec tunnel also reside in a PBF instead of being in the default virtual router? Either would work but putting this in the default VR is simpler and I tend to like simplier solutions. Thoughts: I wonder if you had considered setting this up with straight up normal route preferences instead of using PBF. You seem to be using static routes, so if the static routes just had the preferences in order of your paths and you setup the path monitoring to bring down the interfaces when the path is not valid, you would get the same failover sequence and behavior. And the configuration would be simplier still.
... View more
