PBR using Route failover

[vishalrsshah]

Hi All,

Our organisation purchased two Mpls link and wants to configure an PBR like such

1) All intranet traffic like dns, ntp shoud go via primary MPLS

2) All internet related traffic should go via Secondary MPLS

3) In case Primary MPLS goes down all traffic (intranet and internet) should go via Secondary MPLS and vice versa.

Please let me know how i can achieve this. Attached Sample Diagram.

[vishalrsshah]

PFA diagram

[rmfalconer]

Are you talking PBR on the routers or PBF on the firewalls?

[vishalrsshah]

Pbf on firewalls alongwith route redundancy using static route monitoring 

[rmfalconer]

If you really want to use PBF on the PA, you could put RFC 1918 toward primary and negate RFC1918 toward secondary. You'll need a default toward each of them as well for the failover to work.

[vishalrsshah]

Could you pls elaborate with statement 'you could put RFC 1918 toward primary and negate RFC1918 toward secondary'. if possible pls share any relatable link.

thanks in advnace.

[rmfalconer]

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/policy-based-forwarding/create-a-p... 

You can set destination addresses as part of the policy.