Zones - members not available as src or dest interface

[riaanb]

Hi I have configured a zone with two IPSec tunnels as its member. Both tunnels route traffic to the same remote FTG, one via an expensive link and the other via ADSL. I would like to apply different traffic prioritisation profiles to traffic in each tunnel for one type of traffic. But, it seems that since creating the zone I can not use either member of the zone as a destination interface in a firewall policy. Is there a way around this? I do not want to duplicate all my rules - Zones are a good solution for this. Thanks

[rwpatterson]

Well if the tunnels are in interface mode, then you have a destination on the other end you can route to. From the CLI, you can set the priority on the static routes. Lower number=higher priority. Each tunnel may (should) have a unique end point.

[riaanb]

Yes, the VPNs are in interface mode. The problem is, at least I think it is, that I have added those interfaces into a zone. I think of the name I gave the phase 1 configuration as the name of the interface, is this correct? So, I had to VPNs, which I called CPT-BL-JNB and CPT-DSL-JNB - these two interfaces are now members of the zone CPT-VPN-JNB I have firewall policies that says: on int1 from local-lan to remote LAN via CPT-VPN-JNB type RDP traffic-shaper HIGH ... etc. What is the destination on the other end that you refer to? How do I specify that in my destination interface?

[emnoc]

I don' t think you can do that. Zone-groups does that, just group interfaces that requires the same policies. How many fwpolicies do you currently need to control over CPT-VPN-JNB?

[rwpatterson]

The static route is built to the interface though, not the zone. I just put some IPSec tunnels into a vendor zone. The VIPs that they have still terminate at the interface, not the zone.... Weird, kinda hard to wrap your head around, but yes. Policies use the zone, routing and VIPS use the interface (even though it' s in the zone).

[riaanb]

I have about 14 policies, so if I have to double them up it would be not too many. But it does complexity for support over the next few years. Bob, are you saying you setup Virtual IPs and used these in firewall policies? I assume one VIP uses on VPN and the VIP the other VPN. What do oyu use as the destination interface? any?? Do you mind giving me an example?

[rwpatterson]

Sure. You have a server on the internal port (192.168.1.2/24), and use WAN1 and WAN2 for Internet (from your ISPs).

 
 config system interface
     edit " internal" 
         set vdom " root" 
         set ip 192.168.1.1 255.255.255.0
         set allowaccess ping https ssh snmp telnet
         set type physical
         set description " Inside (gateway) interface" 
     next
     edit " wan1" 
         set vdom " root" 
         set ip 10.10.10.1 255.255.255.0
         set allowaccess ping https
         set type physical
         set description " Outside (Internet) interface" 
         set alias " ISP1" 
     next
     edit " wan2" 
         set vdom " root" 
         set ip 10.10.20.1 255.255.255.0
         set allowaccess ping https
         set type physical
         set description " Outside (Internet) interface" 
         set alias " ISP2" 
     next
 end

Putting WAN1 and WAN2 into the ' Internet' zone, policies would be written ' internal -> Internet' .

 config system zone
     edit " Internet
             set interface " wan1"  " wan2" 
     next
 end

Routing would still need static routes to both ISP' s (with weights and/or fail over configured). The VIP definitions would be:

 config firewall vip
     edit " vIP.wan1 HTTP" 
         set extip 10.10.10.2
         set extintf " wan1" 
         set portforward enable
         set mappedip 192.168.1.2
         set extport 80
         set mappedport 80
     next
     edit " vIP.wan2 HTTP" 
         set extip 10.10.20.2
         set extintf " wan2" 
         set portforward enable
         set mappedip 192.168.1.2
         set extport 80
         set mappedport 80
     next
 end

Notice, nowhere do you see any reference to the zone. Zones are only for configuring policies. The inward policies for the web server would be:

 config firewall policy
     edit 1
         set srcintf " Internet" 
         set dstintf " internal" 
             set srcaddr " all"              
             set dstaddr " vIP.wan1 HTTP"              
         set action accept
         set comments " Web server traffic" 
         set schedule " always" 
             set service " HTTP"              
     next
     edit 2
         set srcintf " Internet" 
         set dstintf " internal" 
             set srcaddr " all"              
             set dstaddr " vIP.wan2 HTTP"              
         set action accept
         set comments " Web server traffic" 
         set schedule " always" 
             set service " HTTP"              
     next
 end

[emnoc]

Good job rwpatterson, but for traffic priorization that would be for outbound. How would the OP conduct that level priorization for let' s say voice ? and from " internal" to " internet" ? I think that was where riaanb is going with this. I think that' s area that I' m not clear on and in regards to his zone-grouping.

[rwpatterson]

Static routes and priorities work, but that' s about it. If it worked with 2 wan ports, it will still work, just now it' s under one policy. Policy routing will still work as well. I' m doing this currently with one of my clients. Just ironed it out a couple of days ago. What a friggin PAIN! <detail> Wan1 50/50Mb, static route priority 10 Wan2 10/2Mb, static route priority 20 (lower, backup circuit) They needed to use mail service on the backup WAN' s server, so I created a policy route for mail (port 25) to the wan2 server. Works like a charm. All other traffic, VIPs, IP phones (yuck!), etc. are on wan1. </detail>

[riaanb]

Hi Bob Thanks for taking the time posting so much details. I am afraid that I still do not see how this will help me prioritise traffic on a specific IPSec VPN different from a different VPN - when both VPN interfaces are part of a zone. Emnoc, I agree, I am interested in outbound prioritisation. In case it is not clear CPT-BL-JNB and CPT-DSL-JNB are two VPNs that terminate between the same two offices routed via different mediums. The idea is to use the DSL VPN as a failover for the other link. But because the DSL is contended we need to apply different traffic shaping prioritisation when in failover. Looks like I will have to dismantle the zones and duplicate the firewall policies... [:' (] edit - spelling