Policy Based routing in aggregate scenario,

[fvelazquez]

Dear all,

I have a configuration on a FG where an aggregated interface (ae1)is having several vlans associated with it, my internal and public "zones" are established under this convention stating that "VLAN1" and "VLAN2" are internal, while "Public" is external:

 edit "ae1"

        set vdom "VDOM1"         set allowaccess https ssh         set type aggregate         set member "port33" "port34"         set snmp-index 50

next

    edit "VLAN1"         set vdom "VDOM1"         set ip 10.178.19.1 255.255.255.0         set allowaccess ping https ssh         set role lan         set snmp-index 54         set interface "ae1"         set vlanid 504     next     edit "VLAN2"         set vdom "VDOM1"         set ip 10.178.20.1 255.255.254.0         set allowaccess ping https ssh         set role lan         set snmp-index 55         set interface "ae1"         set vlanid 505

   next  edit "Public"         set vdom "VDOM1"         set ip 192.107.69.7 255.255.255.0         set role lan         set snmp-index 57         set interface "ae1"         set vlanid 374

.......etc.

My vlan facing internet is "Public", as implied, and the default routing I have, is the following, since I have two internet links above the Fg:

 edit 25         set gateway 192.107.69.1         set priority 10         set device "Public"         set comment "Route to Internet"     next     edit 26         set gateway 192.107.69.2         set priority 5         set device "Public"         set comment "Route to Internet"     next     edit 27 Question is: I want to configure PBR in order to split traffic; half of my servers in "VLAN2" need to go to one link on 192.107.69.1, and half of the servers in that same "VLAN2" need to go to 192.107.69.2. Is the configuration below for PBR enough? How FG behaves in this case, when I am having an aggregated interface with vlans, to split traffic? Is there any other solution for this configuration I have on vlans and aggregated interfaces?:

PBR config:

config router policy     edit 1         set input-device "VLAN2"         set srcaddr "Group_of_servers1"         set dstaddr "all"         set gateway 192.107.69.1         set output-device "Public"     next     edit 2         set input-device "VLAN2"         set srcaddr "Group_of_servers2"         set dstaddr "all"         set gateway 192.107.69.2         set output-device "Public"             next

[emnoc]

Routing has no base or relationship with layer2 or  vlans. So your PBR  definition could care less if it was port or  vlan or anything else as far as that goes.

Ken Felix

[fvelazquez]

Emnoc (Ken Felix):

Thank you very much for your answer. Actually that was a big doubt, because it was not so clear for me, how I should handle this scenario, since all the examples I have looked so far are involving physical/separated interfaces when using PBR. So as far as I understood, if my traffic is matching a correct security policy, and the gateways in the configuration posted are reachable...the PBR should work normally, right?

Kind Regards,