Choosing a default (unknown) route based on a packet's source-ip

[clintmiller]

Hi,

Let's say I have 2 networks connected to my SSG140:

• 192.168.11.0/24 
• 192.168.12.0/24

I want to send traffic from the .11.0/24 subnet with an unknown destination out interface eth0/2 via gateway 1.1.1.1. As you can imagine, I currently do this by setting the default gateway in the route table. The configuration change I want to make should result in sending traffic from the .12.0/24 subnet with an unknown destination out another interface, say eth0/3 via gateway 2.2.2.2.

Can this be accomplished by source-based routing? I originally thought that I could do so, but from my reading about SBR in the docs and the ScreenOS cookbook, SBR will take precedence over destination based routing (good), but if it only chooses a route based on a packet's source IP, how will the SSG route traffic in .12.0/24 to .11.0/24 (i.e., the packet source IP prefix will match the route in the SBR table and flow out eth0/3 via gateway 2.2.2.2 before if ever has a chance to actually get routed to the right place.).

Can anyone provide some insight on how to set this up?

Thanks!

Clint 

[Cesar]

My suggestion is to use another SBR from .12.0/24 to .11.0/24

[clintmiller]

I don't understand: if SBR only uses the packet's source-IP to select a route, how do I express that only packets with a source-IP of .12.0/24 AND an unknown destination flow out a certain interface with a next-hop gateway.

[AndyT]

would be worth investigating whether you can achieve this using different virtual routers?

[muttbarker]

While it is true that source based is normally higher in preference that can be changed. So what about specifying a destination based route for the 11.0 to 12.0 traffic (and vice versa) and giving the destination route table a higher preference. Then that table will be checked first for the "local routes" and then the source based route table will be checked for the egress routes?