We are running PanOS-10.0.2 on our PA-220 and we are having an issue with a PBF rule which seems to be denied even though it should match the traffic. The setup: 2 WAN interfaces: Primary = PPPoE interface on ETH 1/5. Route is added to router when PPPoE is online with metric 10 Secondary = "Normal" interface on ae1.100. Static route is in router with metric 20 For this example, I will use the IP's 1.2.3.4 for Primary and 5.6.7.8 for secondary For both interfaces ping is allowed and there is a PBF rule added with Enforce Symmetric Return: Primary WAN is working fine and failover is going as expected as soon as the PPPoE goes offline. Only issue is when both WAN are online, a ping to the secondary WAN is not working. What happens is: Ping from random WAN IP to 5.6.7.8 No response is received Packet trace shows that the reply is sent over eth1/5 with 5.6.7.8 as source IP Because of the PBF rule I would expect the reply to use the same interface, but instead it seems to ignore this and use the route with lowest metric. Anyone around who has an idea why this is not working?
... View more