topic Re: R80.20 PBR: source ip settings are ignored? Is this a bug? in Firewall and Security Management

R80.20 PBR: source ip settings are ignored? Is this a bug?

supiarmando — Fri, 28 May 2021 15:46:38 GMT

> show pbr summary
PBR Summary

PBR has 3 tables
PBR table RouteToGuestWLANDHCPServer (ID=1) has 1 route
Default route, nexthop gateway
gateway eth4.543
preference 1
PBR table RouteToFW6 (ID=4) has 1 route
Default route, nexthop gateway
gateway 192.168.2.6
preference 1
PBR table RouteToFW20 (ID=5) has 1 route
Default route, nexthop gateway
gateway 192.168.5.20
preference 1

PBR has 5 rules
PBR rule 5 from 172.16.80.16/28 table 4
PBR rule 10 from 172.16.28.0/23 to 192.168.4.85/32 table 1
PBR rule 20 from 172.16.28.0/23 table 5
PBR rule 30 from 172.16.27.0/28 to 192.168.4.85/32 table 1
PBR rule 50 from 172.16.27.0/28 table 4

Sadly traffic from 172.16.28.0/23 or 172.16.27.0/28 both is routed to 192.168.5.20 (table5). If we change prio of rule 50 to 9 than traffic from 172.16.28.0/23 or 172.16.27.0/28 both is routed to 192.168.2.6 (table4).

But we would expect that

-traffic from 172.16.28.0/23 > 192.168.5.20 (table5)

-traffic from 172.16.27.0/28 > 192.168.2.6 (table4)

???

Any help is very appreciated. Thank you

Re: R80.20 PBR: source ip settings are ignored? Is this a bug?

the_rock — Fri, 28 May 2021 16:03:37 GMT

Ok, forgive me for my ignorance, but I dont see any rule for traffic you expect here. Am I missing something?

Re: R80.20 PBR: source ip settings are ignored? Is this a bug?

supiarmando — Fri, 28 May 2021 16:12:44 GMT

hmmm, i do see the point.

There are match and action criteria. What else is required for pbr? What exactly are you missing?

PBR rule 5 from 172.16.80.16/28 table 4

PBR table RouteToFW6 (ID=4) has 1 route
Default route, nexthop gateway
gateway 192.168.2.6

???

Traffic from 172.16.80.16/28 is routed to 192.168.2.6 as next hop.

Re: R80.20 PBR: source ip settings are ignored? Is this a bug?

the_rock — Fri, 28 May 2021 16:20:37 GMT

That looks correct...sorry, give me exact source and destination thats not working?

Re: R80.20 PBR: source ip settings are ignored? Is this a bug?

supiarmando — Fri, 28 May 2021 16:44:47 GMT

traffic from

172.16.28.0/23 and 172.16.27.0/28 both matches the same action table!!! This is the problem.

Re: R80.20 PBR: source ip settings are ignored? Is this a bug?

PhoneBoy — Fri, 28 May 2021 21:22:30 GMT

Sounds like a bug and you should engage with the TAC.