Normally, when traffic enters the firewall, the ingress interface virtual router dictates the route that determines the outgoing interface and destination security zone based on destination IP address. By creating a policy-based forwarding (PBF) rule , you can specify other information to determine the outgoing interface, including source zone, source address, source user, destination address, destination application, and destination service. The initial session on a given destination IP address and port that is associated with an application will not match an application-specific rule and will be forwarded according to subsequent PBF rules (that do not specify an application) or the virtual router’s forwarding table. All subsequent sessions on that destination IP address and port for the same application will match an application-specific rule. To ensure forwarding through PBF rules, application-specific rules are not recommended.

When necessary, PBF rules can be used to force traffic through an additional virtual system using the Forward-to-VSYS forwarding action. In this case, it is necessary to define an additional PBF rule that will forward the packet from the destination virtual system out through a particular egress interface on the firewall.

The following tables describe the policy-based forwarding settings:

The Policy Based Forwarding page also includes an Express Forwarding checkbox. When you select this option on a security policy rule, the firewall programs an express forwarding flag into the Flow Engine, bypassing the Traffic Manager (TM) module for matching sessions. This reduces latency to below 5 microseconds for hardware-offloaded packets. Features that depend on the TM module, such as Quality of Service (QoS) and Multicast, are not supported for traffic that matches policies with express forwarding enabled. This option is available on PA-5540, PA-5550, PA-5560, PA-5570, and PA-5580 platforms only and requires PAN-OS 12.1.10 or later.

Refer to Policy-Based Forwarding