Policy Based routing in aggregate scenario,
Dear all,
I have a configuration on a FG where an aggregated interface (ae1)is having several vlans associated with it, my internal and public "zones" are established under this convention stating that "VLAN1" and "VLAN2" are internal, while "Public" is external:
edit "ae1"
set vdom "VDOM1" set allowaccess https ssh set type aggregate set member "port33" "port34" set snmp-index 50
next
edit "VLAN1" set vdom "VDOM1" set ip 10.178.19.1 255.255.255.0 set allowaccess ping https ssh set role lan set snmp-index 54 set interface "ae1" set vlanid 504 next edit "VLAN2" set vdom "VDOM1" set ip 10.178.20.1 255.255.254.0 set allowaccess ping https ssh set role lan set snmp-index 55 set interface "ae1" set vlanid 505
next edit "Public" set vdom "VDOM1" set ip 192.107.69.7 255.255.255.0 set role lan set snmp-index 57 set interface "ae1" set vlanid 374
.......etc.
My vlan facing internet is "Public", as implied, and the default routing I have, is the following, since I have two internet links above the Fg:
edit 25 set gateway 192.107.69.1 set priority 10 set device "Public" set comment "Route to Internet" next edit 26 set gateway 192.107.69.2 set priority 5 set device "Public" set comment "Route to Internet" next edit 27 Question is: I want to configure PBR in order to split traffic; half of my servers in "VLAN2" need to go to one link on 192.107.69.1, and half of the servers in that same "VLAN2" need to go to 192.107.69.2. Is the configuration below for PBR enough? How FG behaves in this case, when I am having an aggregated interface with vlans, to split traffic? Is there any other solution for this configuration I have on vlans and aggregated interfaces?:
PBR config:
config router policy edit 1 set input-device "VLAN2" set srcaddr "Group_of_servers1" set dstaddr "all" set gateway 192.107.69.1 set output-device "Public" next edit 2 set input-device "VLAN2" set srcaddr "Group_of_servers2" set dstaddr "all" set gateway 192.107.69.2 set output-device "Public" next
