# PAN-OS PBF & multi-VR — override the FIB on purpose

Source: https://ai.techclick.in/blog_paloalto_pbf_multivr
Markdown: https://ai.techclick.in/blog_paloalto_pbf_multivr.md
Publisher: Techclick Infosec Pvt Ltd

PAN-OS PBF vs the FIB: monitor-target failover, Symmetric Return, multi-VR next-vr. When to use PBF vs ECMP vs multi-VR, then prove it with show pbf rule all.

Quick answer (say this out loud)

    PBF  overrides the virtual router’s routing table for a first-match flow: you pick the egress interface (and next hop) from source, dest, user, or service — not from the destination FIB. Attach  Monitor  and  Disable this rule if nexthop/monitor ip is unreachable  so a dead primary ISP falls back to the static default.  Enforce Symmetric Return  pins the reply to the MAC that sent the SYN — it needs a source  interface , not only a zone.  ECMP  load-balances up to four  equal-cost  routes in one VR; it is not a policy override, and it will not install routes whose next hop is another VR.  Multi-VR + Next VR  is the structural dual-ISP design: each ISP owns a RIB, you stitch with one hop, and you leave PBF for tactical exceptions. Prove with  show pbf rule all  (Active vs Disabled) and  show session id  egress.

## 1. Why the FIB is “right” and still wrong

 Normally the firewall uses the destination IP to pick the outgoing interface. The lookup is the routing table of the virtual router that owns the ingress interface. That is the FIB doing its job.

 Guest WiFi and corp LAN can share one default route to ISP1 and still need different exits. The FIB has no “source zone = guest” column.  Policy-Based Forwarding  is the official override: match the packet, specify the egress, skip that destination lookup.

   Hero · who talks to whom

   Notice one box, two exits: corp can keep the premium ISP; guest can be forced onto the cheap one. The FIB alone cannot split them.

 Three tickets this model closes:

- Guest still uses ISP1. There is no PBF match, or the monitor already disabled the rule, so the packet fell through to the default route.

- Primary ISP died and users hung. PBF had no monitor, so sessions kept aiming at a dead next hop.

- Inbound on ISP2 replies out ISP1. Asymmetric SYN / SYN-ACK. You needed Symmetric Return, or a per-ISP VR so the return FIB is already correct.

   Hard words before the runbook

    FIB  — Forwarding Information Base. The best route(s) the virtual router actually uses to forward. The RIB holds candidates; the FIB is what the packet hits.

    PBF  — Policy-Based Forwarding. A first-match policy that overrides the routing table and sets the egress (or discards, or skips PBF).

    Monitor / path monitoring  — ICMP heartbeats to a target IP (or to the next hop if you leave the target blank). On failure you can disable the PBF rule so the VR routes, or keep the rule and use fail-over / wait-recover.

    Enforce Symmetric Return  — return traffic is sent back to the MAC that delivered the SYN (first packet), skipping the return FIB. Requires a source  interface .

    Next VR  — a static-route next-hop type. The next hop is another virtual router on the same firewall. One hop only (A→C, not A→B→C).

    ECMP  — Equal Cost Multiple Path. Up to four equal-cost routes to the same dest in one VR’s FIB. Load-balances  sessions . Not a source-based policy.

## 2. Mental model

 Memorize three layers. PBF is the override. The VR FIB is the default. A second VR is a second default.

#### 1 · PBF first-match

 Top-down, like Security. First rule that matches source (zone or interface), dest, user, application/service wins. Later PBF rows are not evaluated.

#### 2 · Then the VR FIB

 No PBF match, or the matching rule is Disabled by the monitor → destination lookup in that interface’s virtual router. ECMP only matters here.

#### 3 · Security and NAT still run

 PBF does not allow or hide anything. You still need a Security allow and, for dual ISP, interface-based source NAT so the reply lands on the same public IP.

#### 4 · Return is a separate problem

 Outbound PBF + correct SNAT often makes the reply come back the same ISP. Inbound or asymmetric designs need Symmetric Return or a per-ISP VR.

   Journey · four stations

   Read left to right: the packet arrives, a PBF row matches, the monitor is up, then egress is the interface you named — not the FIB default.

   Say this out loud

   PBF is evaluated before the destination FIB. A match overrides the route table. A monitor can disable that override. Symmetric Return overrides the  return  lookup. Multi-VR gives each ISP its own table so you stop fighting the FIB.

## 3. Decision flow (PBF before FIB)

 Flowchart first. A new session from  trust  to the internet hits this order — not “route, then maybe PBF.”

   Flow 1 · PBF vs FIB

       New session: PBF first-match, then monitor, then FIB fallback

- New SYN ingress L3 IF PBF match? top-down yes Monitor up? or no monitor yes PBF Action Forward / Discard / No PBF no match down + disable-rule VR FIB lookup default / ECMP / static Security + NAT still required Egress Return path is not this chart SNAT to the egress IP · or Enforce Symmetric Return (source IF) · or per-ISP VR so the return FIB is already right Read left → right, then down. Diamond = decision. No PBF match, or a disabled PBF rule, is the only way the destination FIB picks the exit. Decision · three tools Caption teaches the split: PBF = policy override, ECMP = equal-cost share in one table, Multi-VR = a second table. Do not stack all three blindly. ## 4. How to choose: PBF vs ECMP vs multi-VR If the requirement is “this class of traffic must leave this interface,” that is PBF. If the requirement is “share two equal links to the same dest,” that is ECMP. If the requirement is “each ISP has its own RIB, inbound and outbound, maybe its own BGP AS,” that is multi-VR. Use When What it cannot do Return path PBF Small, named override: guest → cheap ISP, HTTP/HTTPS → primary ISP, leased line for one service. Official dual-ISP use case: PBF to primary + monitor + static default to backup. Not a second routing table. App-ID is too late — do not match YouTube. Loopback is not a PBF source. Custom apps / filters / groups are not allowed. Pair with interface-based SNAT. Add Enforce Symmetric Return only for inbound / asymmetric. Watch show pbf return-mac all . ECMP One VR, up to four equal-cost routes to the same dest, you want session load-share and faster link-fail shift inside that VR. Not source-aware. Official: ECMP is not supported when one of the equal-cost routes has a virtual router (or logical router) as next hop — none of those routes install in the FIB. Replies follow the public IP you SNATed to. Mixing ECMP across two ISPs without per-ISP NAT is how sessions break. Multi-VR + Next VR True dual-ISP both directions, BGP Local AS per ISP (one AS per VR), servers published on both publics, or PBF + Symmetric Return has grown into a pile of rules. VRs do not share routes unless you wire them. Only one hop between VRs. ECMP will not hash across a Next-VR hop. Each ISP VR has its own default and a static for the LAN via Next VR. Return is a FIB problem again — usually what you want. Unsafe vs safe path Unsafe: 30 PBF rows + Symmetric Return on “any” + ECMP on two ISP defaults in the same VR + a Next-VR static “for failover.” That design fights itself. ECMP will not install the Next-VR path; return-mac grows; guest and corp share a broken default. Safe: Pick one primary tool. Dual-ISP outbound-only → official PBF + monitor + backup static + per-ISP DIPP. Dual-ISP both ways / BGP per ISP → one VR per ISP + Next VR. Keep PBF for the one guest or QoS exception. ## 5. Runbook · Side A interfaces, Side B PBF + next-vr, Side C proof Lab addressing (RFC 5737 / 5735): ethernet1/3 trust 192.168.54.1/24 , ethernet1/1 ISP1 203.0.113.2/30 gw 203.0.113.1 , ethernet1/2 ISP2 198.51.100.2/30 gw 198.51.100.1 . Official dual-ISP write-up puts both egress interfaces in one zone; you may also use untrust-isp1 / untrust-isp2 if Security must distinguish them. ### Side A — interfaces, VR, backup static, NAT objects #### Layer 3 interfaces in a VR Network → Interfaces . Only Layer 3 interfaces support PBF; loopback does not. Assign each interface to a virtual router (start with default for the single-VR PBF design). Official dual-ISP example uses zone Corporate on the LAN and one egress zone for both ISPs.

- #### Backup default in the FIB Network → Virtual Routers → default → Static Routes → Add . Destination 0.0.0.0/0 , Next Hop = IP Address 198.51.100.1 (backup ISP). This is the route that wins when PBF is Disabled. Do not point this default at Next VR if you also plan ECMP in this same VR.

- #### Negate internal destinations Objects → Addresses for the internal range you must not PBF (example 10.0.0.0/8 ). Official dual-ISP step: add those addresses on the PBF Destination tab and tick Negate so LAN-to-LAN never leaves toward an ISP.

 Source for Side A:  Use Case: PBF for Outbound Access with Dual ISPs .

### Side B — PBF rule, then optional Next VR

- #### Add the PBF rule Policies → Policy Based Forwarding → Add . General : Name pbf-corp-isp1 . Required: a name, a source zone or interface, and (for Forward) an egress interface.

- #### Source Source → Type . Use Zone = trust for outbound-only. Switch Type to Interface (the LAN L3 IF) if you will tick Enforce Symmetric Return — official docs: Symmetric Return requires a source interface.

- #### Destination / Application / Service Destination Address = internal object, Negate checked. Service = Add service-http and service-https (official dual-ISP). Leave Application empty when you can. PBF is applied on the first packet (SYN) or first response (SYN/ACK), before App-ID is sure. You cannot use custom applications, application filters, or application groups.

- #### Forwarding Action = Forward . Egress Interface = ethernet1/1. Next Hop = IP Address 203.0.113.1 (IPv4 object must be /32). Other actions: Discard , No PBF (matched packets use the route table — useful as an exception row), Forward to VSYS on multi-vsys.

- #### Monitor Tick Monitor , attach the default monitoring profile. Tick Disable this rule if nexthop/monitor ip is unreachable . Leave Target IP blank to ping the next hop, or set a far IP that is only reachable via this egress. Official table: when the rule is disabled, new sessions check remaining PBF rows then the routing table; established sessions also leave PBF and use the routing table.

- #### Symmetric Return — only if inbound is asymmetric Tick Enforce Symmetric Return and Add up to 8 IPs on Next Hop Address List (the upstream router that delivered the SYN). You cannot list a Tunnel or PPPoE address. Same-subnet dest IPs skip Symmetric Return on purpose so the packet is not silently discarded.

- #### Per-ISP source NAT + Security Policies → NAT : DIPP, Address Type = Interface Address , one rule per egress IF. Policies → Security : allow trust → egress zone, Log at Session End. PBF does not replace either rulebase.

- #### If you chose multi-VR instead Network → Virtual Routers → Add VR-ISP1 , VR-ISP2 , keep LAN on VR-Internal . Move each ISP interface into its VR. Static on VR-Internal: dest 0.0.0.0/0 , Next Hop = Next VR → VR-ISP1 . On each ISP VR: dest LAN prefix, Next Hop = Next VR → VR-Internal , plus a default to that ISP gateway. Do not add Next VR between the two ISP VRs unless you want ISP-to-ISP transit. Official: only one hop between VRs.

     https://fw.lab.example.com/#policies/pbf
     Training mock · not live

       Policies → Policy Based Forwarding → Add

### PBF Policy Rule

         General
         Source
         Destination / App / Service
         Forwarding

          Name (General)  pbf-corp-isp1

          Action  Forward

          Egress Interface  ethernet1/1

          Next Hop  IP Address · 203.0.113.1/32

          Monitor  On · Profile default · Disable rule if unreachable

          Monitor IP Address  (blank = next hop)

          Enforce Symmetric Return  Off (outbound + DIPP)

          Next Hop Address List  (add only if Symmetric Return)

         Cancel
         OK · then Commit

    Click next:  Source tab Type = Zone  trust  (or Interface if Symmetric Return), Destination Negate internals, Service  service-http  /  service-https , then Policies → NAT DIPP on ethernet1/1. Source: Create a Policy-Based Forwarding Rule + Dual-ISP use case.

     https://fw.lab.example.com/#network/virtual-routers
     Training mock · not live

       Network → Virtual Routers → VR-Internal → Static Routes → Add

### Static Route

         IPv4
         IPv6

          Name  default-via-vr-isp1

          Destination  0.0.0.0/0

          Interface  None

          Next Hop  Next VR

          Virtual Router  VR-ISP1

          Admin Distance / Metric  10 / 10

          Route Table  Unicast

          Path Monitoring  Off (monitor lives on the ISP VR default)

         Cancel
         OK · mirror LAN via Next VR on VR-ISP1

    Click next:  on VR-ISP1 add dest  192.168.54.0/24  Next Hop = Next VR  VR-Internal , plus  0.0.0.0/0  via  203.0.113.1 . Repeat for VR-ISP2. Source: Network → Virtual Routers → Static Routes (Next VR).

 Source for Side B clicks:  Create a Policy-Based Forwarding Rule  and  Static Routes (Next VR) .

### Side C — prove rule state and egress

- #### Confirm the PBF row is Active Official dual-ISP verify: show pbf rule all . You want Rule State = Active , Action Forward, the intended egress IF and next hop. After you unplug the primary (or fail the monitor), the same command must show Disabled .

- #### Session egress + NAT Generate HTTPS from a trust host. show session all , then show session id   . Quote ingress interface , egress interface , nat-rule . On primary-up, egress is ethernet1/1 and the ISP1 NAT rule. On primary-down, egress is ethernet1/2 and the backup NAT — and the PBF rule is not listed on that session.

- #### Symmetric Return table (only if you enabled it) show pbf return-mac all — official command to see the model-limited table. clear pbf return-mac all (or name ) during a change window if an upstream MAC moved (HSRP/VRRP) and replies hang.

- #### Multi-VR FIB show routing route virtual-router VR-Internal and the same on each ISP VR. Confirm the default is Next VR (or the ISP gateway) and that there is no ISP1↔ISP2 Next-VR unless you designed transit.

   Dummy evidence · show pbf rule all (primary up)
   admin@PA-NGFW> show pbf rule all
Rule            ID  Rule State  Action   Egress IF/VSYS  NextHop
==============  ==  ==========  ======   ==============  =========
pbf-corp-isp1    1  Active      Forward  ethernet1/1     203.0.113.1

   Dummy evidence · same rule after monitor failure
   admin@PA-NGFW> show pbf rule all
Rule            ID  Rule State  Action   Egress IF/VSYS  NextHop
==============  ==  ==========  ======   ==============  =========
pbf-corp-isp1    1  Disabled    Forward  ethernet1/1     203.0.113.1

   Dummy evidence · show session id (backup path, PBF not used)
   admin@PA-NGFW> show session id 87212
        ingress interface             : ethernet1/3
        egress interface              : ethernet1/2
        nat-rule                      : NAT-Backup-ISP(vsys1)
        application                   : ssl
        rule                          : allow-trust-web

   Green success

   Primary up: Rule State Active, session egress ethernet1/1,  natsrc  is the ISP1 interface IP. Primary down: Rule State Disabled, new session egress ethernet1/2, backup NAT, PBF name absent from the session. That pair closes the ticket. Source: official Dual-ISP use case verify steps.

## 6. Runtime path after commit

 After go-live the user does not care about your object names. One HTTPS SYN from a trust laptop does this.

   Flow 2 · multi-VR next-vr (structural dual-ISP)

       VR-Internal stitched to VR-ISP1 and VR-ISP2 with Next VR, no ISP-to-ISP path

- Trust LAN 192.168.54.0/24 ethernet1/3 VR-Internal 0.0.0.0/0 → Next VR VR-ISP1 (primary) one hop only VR-ISP1 default → 203.0.113.1 LAN → Next VR VR-Internal VR-ISP2 default → 198.51.100.1 LAN → Next VR VR-Internal No Next-VR between VR-ISP1 and VR-ISP2 = no ISP transit Inbound on ISP2 is forwarded by VR-ISP2, then Next VR into VR-Internal. The reply looks up VR-Internal → you install the return prefix via VR-ISP2, not via the ISP1 default. SYN arrives on ethernet1/3. PBF evaluates top-down. pbf-corp-isp1 matches trust + service-https, destination is not the negated LAN prefix.

- Monitor to 203.0.113.1 is up → Action Forward, egress ethernet1/1, next hop 203.0.113.1 . The destination FIB is not consulted.

- Security allow + DIPP on ethernet1/1 rewrite the source to 203.0.113.2 . Session installs with that egress.

- If the monitor fails and Disable-rule is checked, Rule State becomes Disabled. The next SYN uses remaining PBF rows, then the VR default out ethernet1/2. Established sessions also leave that PBF path (official monitor table).

- On a multi-VR design this SYN never needed PBF: VR-Internal’s only default is Next VR to VR-ISP1, and VR-ISP1’s default is ISP1.

## 7. Traps + proof checklist

   Proof · ops desk

   Close the ticket with Rule State + egress IF + nat-rule — not with “ping still works from the firewall.”

        Failure  Looks like  Actual  Proof

         PBF never hits
         Guest still on ISP1
         No match (wrong source Type, dest not negated so an earlier No-PBF row stole it, or you matched Application and App-ID was late)
          show pbf rule all  + session has no PBF; rewrite Service to  service-http  /  service-https

         Monitor flap / no failover
         Users hang when ISP1 dies
         Monitor off, or Disable-rule unchecked so the rule stays enabled and new sessions still prefer a dead egress until you understand wait-recover vs fail-over
         Unplug primary → Rule State Disabled → new  show session id  egress is the backup IF

         Asymmetric inbound
         SYN on ISP2, SYN-ACK out ISP1, session dies
         Single VR FIB default ≠ ingress ISP. Symmetric Return off, or Source Type is still Zone
         Source Type = Interface; Enforce Symmetric Return + Next Hop Address List; or move to multi-VR

         return-mac full / stale MAC
         Some inbound sessions hang; no Security deny
         Model-limited Symmetric Return table (not user-sizable). Official check is  show pbf return-mac all . Upstream HSRP MAC change leaves a stale entry
          show pbf return-mac all ;  clear pbf return-mac all  in a window; narrow the rule or drop Symmetric Return after multi-VR

         ECMP + Next VR
         “We enabled ECMP for dual ISP”
         Official: ECMP will not install equal-cost routes when a next hop is a virtual router
          show routing fib  — the Next-VR path is missing from the ECMP set

         ISP-to-ISP transit
         One ISP can reach the other through you
         You added Next VR between VR-ISP1 and VR-ISP2
         No such static; plus a Security deny untrust-isp1 → untrust-isp2

   Pilot checklist

- One laptop in trust , HTTPS out — session egress = ethernet1/1, Rule State Active.

- Same laptop to an internal prefix — PBF does not match (Negate). Session stays on-net.

- Fail the primary next hop — Rule State Disabled within the monitor threshold; new session egress = ethernet1/2; backup NAT name in show session id .

- Restore primary — rule returns to Active; new sessions use PBF again.

- If Symmetric Return is on: show pbf return-mac all shows the upstream MAC and is not at the model cap.

- If multi-VR: show routing route virtual-router VR-ISP1 has LAN via Next VR; no ISP1↔ISP2 Next-VR.

   Interview angle

    Weak:  “PBF is policy-based routing.”  Strong:  “PBF is a first-match override of the VR FIB on the first packet. I monitor the next hop and disable the rule so the backup static takes new and established sessions. Symmetric Return needs a source interface and a finite return-mac table. Dual-ISP both ways is multi-VR with Next VR, one hop, not 40 PBF rows. ECMP is equal-cost session share in one VR — and it will not hash to another VR.”

## Knowledge check

   Six judgment items. Map each miss back to the flow, choose table, or traps — then retry.

       Q1
       Guest WiFi has a PBF Forward to ISP2. The VR default route still points at ISP1. A guest laptop opens HTTPS. What happens first?

           Destination FIB lookup, then PBF as a tiebreaker if two defaults exist
           PBF first-match. A hit overrides the routing table. The FIB runs only if no PBF rule matches (or the matching rule is Disabled)
           Security policy runs first and picks the egress zone
           ARP for 8.8.8.8, then PBF

       Correct:  b . Official PBF purpose is to override the routing table. Re-read  Decision flow  and the Quick answer.

       Q2
       The PBF monitor target is down.  Disable this rule if nexthop/monitor ip is unreachable  is checked. A  new  HTTPS session matches only that one PBF row. What does PAN-OS do?

           Drop the SYN. Disable-rule means blackhole
           Keep using the PBF egress for new and established sessions until you commit
           The rule is Disabled. New sessions check remaining PBF rules; if none match, they use the routing table (your backup default)
           The firewall fails the HA pair so the peer can route

       Correct:  c . Official Path Monitoring for PBF table: rule disabled + new session → remaining PBF, else routing table. Established sessions also leave PBF when the rule is disabled. Re-read Side B Monitor and  traps .

       Q3
       Inbound HTTPS on ISP2 replies out ISP1 and the session dies. The engineer ticked Enforce Symmetric Return on a PBF row whose Source Type is Zone. Why is that incomplete?

           Symmetric Return requires a source  interface , not only a zone, so the firewall can pin the return to the MAC that sent the SYN
           Symmetric Return only works if Application is ssl
           You must enable ECMP first
           Next Hop must be FQDN

       Correct:  a . Create a PBF Rule: “If you want to enforce symmetric return, you must select a source interface.” Re-read Side B and  mental model  part 4.

       Q4
       A site publishes servers on both ISP publics, runs BGP with a different Local AS per ISP, and already has 30 PBF + Symmetric Return rows.  show pbf return-mac all  is climbing. What is the right structural move?

           Add more PBF rows and raise the return-mac table in CLI
           Turn on ECMP in the same VR and keep all 30 PBF rules
           Set every PBF Action to Discard
           One VR per ISP plus VR-Internal, stitch with Next VR (one hop), and keep PBF only for a tactical exception such as guest WiFi

       Correct:  d . One BGP Local AS per VR; VRs do not share routes unless you wire Next VR; Symmetric Return table is model-limited and not user-sizable. Re-read  How to choose .

       Q5
       A team enables ECMP on VR-Internal because two statics exist:  0.0.0.0/0  Next VR VR-ISP1 and  0.0.0.0/0  Next VR VR-ISP2. What does official ECMP behaviour say?

           ECMP hashes sessions across the two Next-VR hops
           ECMP is not supported when one or more equal-cost routes have a virtual router as next hop — none of those routes are installed in the FIB
           PBF is automatically deleted
           Symmetric Return replaces ECMP after commit

       Correct:  b . Official ECMP page. Re-read the choose table and the ECMP + Next VR trap.

       Q6
       An engineer matches Application = youtube on a PBF rule so video uses ISP2. What is the production-correct statement?

           Correct — App-ID is known on the first SYN
           Correct if SSL decryption is on
           Wrong. PBF may run on the first packet before App-ID. Prefer a service object (tcp/443). You cannot use custom apps, application filters, or application groups in PBF
           Use Action Discard and rely on Security to allow YouTube

       Correct:  c . Official “Service Versus Applications in PBF.” Re-read Side B Destination / Application / Service.

       Check answers
       Reset

## Sources

- Policy-Based Forwarding — PBF overrides the routing table; dest-IP lookup is the default.

- PBF overview — alternate egress for security or performance (leased line vs internet).

- Create a Policy-Based Forwarding Rule — Policies → Policy Based Forwarding; source Zone vs Interface; Symmetric Return needs an interface; L3 only, no loopback; Actions Forward / Forward to VSYS / Discard / No PBF; Next Hop IP / FQDN / None; Monitor + Disable this rule; Next Hop Address List (max 8).

- Path Monitoring for PBF — ICMP heartbeats; disable-rule vs wait-recover / fail-over; new vs established session table.

- Egress Path and Symmetric Return — return to the SYN MAC; same-subnet exception; model-limited table via show pbf return-mac all .

- Service Versus Applications in PBF — first packet / SYN-ACK; prefer service objects; no custom app / filter / group.

- Use Case: PBF for Outbound Access with Dual ISPs — PBF to primary + monitor + backup static + per-ISP DIPP; show pbf rule all Active vs Disabled; show session id .

- Configure Virtual Routers — RIB → FIB; one best route unless ECMP; Next VR one hop; routes not shared across VRs; one BGP Local AS per VR.

- Static Routes — Next Hop = IP Address / Next VR / FQDN / Discard / None; path monitoring defaults (ping interval 3, count 5).

- ECMP — up to four equal-cost paths; session load-share; not supported when a next hop is a virtual router.

 Related:  Zones, interfaces, VR  ·  NAT deep dive  ·  Session factory  ·  Session table and flow  ·  Traffic not passing  ·  SP3 architecture  ·  Palo Alto interview hub  ·  Palo Alto course

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt