Configure a Policy Based Forwarding Rule

Log in to
Strata Cloud Manager
.
Select
Manage
Configuration
NGFW and Prisma Access
Network Services
Policy Based Forwarding
and select the Configuration Scope where you want to configure the PBF rule.
You can select a folder or firewall from your
Folders
or select
Snippets
to configure the PBF rule in a snippet.
Add Rule
.
Enter a descriptive
Name
for the PBF rule.
(
Optional
) Enter a
Description
for the PBF rule.
Select the PBF rule
Position
.
Pre-Rule
—Policy rule is added to the top of the rule order and evaluated head of any locally defined policy rules and post-rules.
If no position is selected, the PBF rule is created as a pre-rule by default.
Post-Rule
—Policy rule is added to the bottom of the rule order and evaluated after the pre-rules and locally defined rules.
(
Optional
) To trigger the specified forwarding
Action
at a daily, weekly, or nonrecurring frequency, select or create a
Schedule
.
Configure the traffic Source.
Select the source
Type
to which you’ll apply the forwarding policy rule.
Zones
—
Add Zones
and select a zone.
Interface
—
Add Interface
and select a Layer 3 interface.
Only Layer 3 interfaces are supported; loopback interfaces don’t support PBF.
To enforce symmetric return, you must select a source interface.
Specify the source
Addresses
to which the PBF policy rule applies.
Individual addresses, address groups, or external dynamic lists (EDL) are supported as source addresses. A PBF policy rule is configured to apply to
Any Address
by default.
Click
Negate
to exclude one or more source addresses from the PBF rule.
Specify the source
Users
to whom the policy rule applies.
Individual users or user groups as source users. A PBF policy rule is configured to apply to
Any User
by default.
Click
Negate
to exclude one or more source users from the PBF rule.
Configure the traffic Destination
Addresses
to which the PBF policy rule applies.
Individual addresses, address groups, or external dynamic lists (EDL) are supported as destination addresses. A PBF policy rule is configured to apply to
Any Address
by default.
Click
Negate
to exclude one or more destination addresses from the PBF rule.
Select the Applications and Services that you want to control using PBF.
(
Optional
)
Add Applications
to add one or more applications to control.
Any Application
is selected by default if you don’t add any applications.
Palo Alto Networks doesn’t recommend application-specific rules for use with PBF. PBF rules might be applied before the firewall has enough information to determine the application. Whenever possible, use a service object, which is a Layer 4 port (TCP or UDP) used by the protocol or application. For more details, see Service Versus Applications in PBF.
Add Services
to add one or more services to control. You can also
Add Service Groups
to add multiple services as a single service entity.
Any Services
is selected by default if you don’t add any services or service groups.
Define the Forwarding action and network information for packets that match the PBF policy rule.
Select the
Action
to take when matching a packet.
Forward
(default)—Directs packet to the specified
Egress Interface
.
Discard
—Drops the packet.
No PBF
—Excludes the packets that match the criteria for source, destination, application, or service defined in the rule. Matching packets use the route table instead of PBF; the firewall uses the route table to exclude the matched traffic from the redirected port.
(
Forward only
) Select the
Egress Interface
to forward matching packets to.
(
Forward only
) Select the
Next Hop
.
None
(default)—The destination IP address of the packet is used as the next hop. Forwarding fails if the destination IP address isn’t in the same subnet as the egress interface.
IP Address
—Enter an IP address or select an address object of type
Ip Netmask
to which the firewall forwards matching packets. An IPv4 address object must have a
/32
netmask.
FQDN
—Enter an FQDN or select or create an address object of type FQDN to which the firewall forwards matching packets. The FQDN must resolve to an IPv4 address.
This FQDN must resolve to an IP address that belongs to the same subnet as the interface you configured for PBF; otherwise, the firewall rejects the resolution and the FQDN remains unresolved.
(
Optional; Forward only
) Enable
Monitor
to verify connectivity to a target IP address or to the
Next Hop
IP address if no IP address is specified.
Select a monitoring
Profile
or
Create New
to specify the action when the monitored address is unreachable.
You can
Disable this rule if nexthop/monitor ip is unreachable
.
Enter a target
IP Address
to monitor.
(
Required for asymmetric routing environments; Optional otherwise
)
Enforce Symmetric Return
and
Add
or more IP address in the
Next Hop Address List
.
You can add up to eight next-hop IP addresses. Tunnel and PPoE interfaces are not supported as a next-hop IP address.
Save
.
Push Config
to push your configuration changes.