Skip to main content
fvelazquez
New Member
November 15, 2018
Question

Policy Based routing in aggregate scenario,

  • November 15, 2018
  • 2 replies
  • 2830 views

 

Dear all,

 

I have a configuration on a FG where an aggregated interface (ae1)is having several vlans associated with it, my internal and public "zones" are established under this convention stating that "VLAN1" and "VLAN2" are internal, while "Public" is external:

 

 edit "ae1"

        set vdom "VDOM1"         set allowaccess https ssh         set type aggregate         set member "port33" "port34"         set snmp-index 50

next

    edit "VLAN1"         set vdom "VDOM1"         set ip 10.178.19.1 255.255.255.0         set allowaccess ping https ssh         set role lan         set snmp-index 54         set interface "ae1"         set vlanid 504     next     edit "VLAN2"         set vdom "VDOM1"         set ip 10.178.20.1 255.255.254.0         set allowaccess ping https ssh         set role lan         set snmp-index 55         set interface "ae1"         set vlanid 505

   next  edit "Public"         set vdom "VDOM1"         set ip 192.107.69.7 255.255.255.0         set role lan         set snmp-index 57         set interface "ae1"         set vlanid 374

.......etc.

 

My vlan facing internet is "Public", as implied, and the default routing I have, is the following, since I have two internet links above the Fg:

 edit 25         set gateway 192.107.69.1         set priority 10         set device "Public"         set comment "Route to Internet"     next     edit 26         set gateway 192.107.69.2         set priority 5         set device "Public"         set comment "Route to Internet"     next     edit 27 Question is: I want to configure PBR in order to split traffic; half of my servers in "VLAN2" need to go to one link on 192.107.69.1, and half of the servers in that same "VLAN2" need to go to 192.107.69.2. Is the configuration below for PBR enough? How FG behaves in this case, when I am having an aggregated interface with vlans, to split traffic? Is there any other solution for this configuration I have on vlans and aggregated interfaces?:

 

PBR config:

 

config router policy     edit 1         set input-device "VLAN2"         set srcaddr "Group_of_servers1"         set dstaddr "all"         set gateway 192.107.69.1         set output-device "Public"     next     edit 2         set input-device "VLAN2"         set srcaddr "Group_of_servers2"         set dstaddr "all"         set gateway 192.107.69.2         set output-device "Public"             next

 

    2 replies

    emnoc
    New Member
    November 15, 2018

    Routing has no base or relationship with layer2 or  vlans. So your PBR  definition could care less if it was port or  vlan or anything else as far as that goes.

     

    Ken Felix

     

    fvelazquez
    New Member
    November 15, 2018

    Emnoc (Ken Felix):

     

    Thank you very much for your answer. Actually that was a big doubt, because it was not so clear for me, how I should handle this scenario, since all the examples I have looked so far are involving physical/separated interfaces when using PBR. So as far as I understood, if my traffic is matching a correct security policy, and the gateways in the configuration posted are reachable...the PBR should work normally, right?

     

    Kind Regards,

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!