Screen OS

Hi Guys,

Little bit of help needed and any help greatly appreciated. I have a SSG20 6.1.0r3 which has 2 ISP connections currently setup as ecmp.

Int adsl1/0 pref0 metric 1

Int Eth0/0 pref0 metric 1

I cant change the preference on the adsl link as this is learned automatically and placed in the routing table, if i change the preference on the second link Eth0/0 I cant route the traffic out that interface. I need to force all port80 traffic out Int Eth0/0, from what i can see I cant use PBR as this would require having no default routes in the routing table and using the PBR policy to route all traffic, Im still only new to this and any help that you could give me is greatly appreciated.

Thanking you all in advance

Alan

Sanitised Config

set interface adsl1/0 phy operating-mode auto
set interface "ethernet0/0" zone "Untrust"
set interface "ethernet0/1" zone "DMZ"
set interface "bgroup0" zone "Trust"
set interface "adsl1/0" pvc 8 35 mux llc protocol bridged qos ubr zone "Untrust"
set interface bgroup0 port ethernet0/2
set interface bgroup0 port ethernet0/3
set interface bgroup0 port ethernet0/4
unset interface vlan1 ip
set interface ethernet0/0 ip 83.xxx.xxx.124/26
set interface ethernet0/0 route
set interface bgroup0 ip 10.0.4.1/24
set interface bgroup0 nat
set interface adsl1/0 ip 62.xxx.xxx.129/29
set interface adsl1/0 route
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface ethernet0/0 ip manageable
set interface bgroup0 ip manageable
set interface adsl1/0 ip manageable
set interface ethernet0/0 manage ping
set interface ethernet0/0 manage ssh
set interface ethernet0/0 manage telnet
set interface ethernet0/0 manage web
set interface adsl1/0 manage ping
set interface adsl1/0 manage ssh
set interface adsl1/0 manage telnet
set interface adsl1/0 manage web
set interface "ethernet0/0" mip 83.xxx.xxx.124 host 10.0.4.85 netmask 255.255.255.255 vr "trust-vr"
set interface "adsl1/0" mip 62.xxx.xxx.129 host 10.0.4.85 netmask 255.255.255.255 vr "trust-vr"
set flow tcp-mss
set flow all-tcp-mss 1304
unset flow no-tcp-seq-check
set flow tcp-syn-check
unset flow tcp-syn-bit-check
set flow reverse-route clear-text prefer
set flow reverse-route tunnel always
set domain educatetogether.ie
set hostname SSG20_Edu_Tog
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
set dns host dns1 10.0.4.85
set dns host dns2 208.67.222.222
set dns host dns3 208.16.220.220
set ike respond-bad-spi 1
set ike ikev2 ike-sa-soft-lifetime 60
unset ike ikeid-enumeration
unset ike dos-protection
unset ipsec access-session enable
set ipsec access-session maximum 5000
set ipsec access-session upper-threshold 0
set ipsec access-session lower-threshold 0
set ipsec access-session dead-p2-sa-timeout 0
unset ipsec access-session log-error
unset ipsec access-session info-exch-connected
unset ipsec access-session use-error-log
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
exit
set url protocol websense
exit
set policy id 1 from "Trust" to "Untrust"  "Any" "Any" "ANY" permit
set policy id 1
exit
set policy id 2 name "PredefinedProtocols" from "Untrust" to "Trust"  "Any" "MIP(62.xxx.xxx.129)" "DNS" permit
set policy id 2 application "HTTP"
set policy id 2
set service "FTP"
set service "HTTP"
set service "HTTP-EXT"
set service "HTTPS"
set service "IMAP"
set service "POP3"
set service "SMTP"
set service "VNC"
exit
set policy id 3 from "Untrust" to "Trust"  "Any" "MIP(62.xxx.xxx.129)" "xxx2" permit
set policy id 3
set service "xxx"
exit
set policy id 4 from "Untrust" to "Trust"  "Any" "MIP(62.xxx.xxx.129)" "VNC 4401" permit
set policy id 4
exit
set policy id 5 name "PredefinedProtocols2" from "Untrust" to "Trust"  "Any" "MIP(83.xxx.xxx.124)" "DNS" permit
set policy id 5
set service "FTP"
set service "HTTP"
set service "HTTP-EXT"
set service "HTTPS"
set service "IMAP"
set service "POP3"
set service "SMTP"
set service "VNC"
exit
set policy id 6 from "Untrust" to "Trust"  "Any" "MIP(83.xxx.xxx.124)" "xxx2" permit
set policy id 6
set service "xxx"
exit
set policy id 7 from "Untrust" to "Trust"  "Any" "MIP(83.xxx.xxx.124)" "VNC 4401" permit
set policy id 7
exit
set pppoe name "Eircom"
set pppoe name "Eircom" username "xxx@eircom.net" password "dM2mEuOiNwcQM6sFC5Ca8UeXCjnFEyFj3g=="
set pppoe name "Eircom" idle 0
set pppoe name "Eircom" static-ip
set pppoe name "Eircom" interface adsl1/0
set pppoe name "Eircom" auto-connect 1
set pppoe name "Eircom" netmask 255.255.255.248
set nsmgmt bulkcli reboot-timeout 60
set ssh version v2
set ssh enable
set config lock timeout 5
unset license-key auto-update
set snmp port listen 161
set snmp port trap 162
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
unset add-default-route
set route 0.0.0.0/0 interface ethernet0/0 gateway 83.xxx.xxx.65 preference 0
set access-list extended 10 src-ip 10.0.4.0/24 dst-port 25-25 protocol any entry 1
set access-list extended 10 src-ip 10.0.4.0/24 dst-port 110-110 protocol any entry 2
set access-list extended 10 src-ip 10.0.4.0/24 dst-port 143-143 protocol any entry 3
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 80-80 protocol any entry 3
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 443-443 protocol any entry 4
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 21-21 protocol any entry 5
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 5800-5800 protocol any entry 6
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 5900-5901 protocol any entry 7
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 220-220 protocol any entry 8
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 7777-7777 protocol any entry 9
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 5190-5190 protocol any entry 10
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 8080-8080 protocol any entry 11
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 4500-4500 protocol any entry 12
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 3283-3283 protocol any entry 13
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 5432-5433 protocol any entry 14
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 5988-5988 protocol any entry 15
set access-list extended 20 src-ip 10.0.4.0/24 dst-port 4401-4401 protocol any entry 16
set match-group name Imagine
set match-group Imagine ext-acl 20 match-entry 1
set match-group name Eircom
set match-group Eircom ext-acl 10 match-entry 1
set action-group name Imagine
set action-group Imagine next-interface ethernet0/0 action-entry 1
set action-group name Eircom
set action-group Eircom next-interface adsl1/0 action-entry 1
set pbr policy name Outbound_PBR
set pbr policy Outbound_PBR match-group Eircom action-group Eircom 1
set pbr policy Outbound_PBR match-group Imagine action-group Imagine 2
exit
set interface bgroup0 pbr Outbound_PBR
set vrouter "untrust-vr"
exit
set vrouter "trust-vr"
exit

Hi,

You should see the PBR as an addition to "normal" routing. PBR is first matched an the "normal" routing.

so if you create a match for you port 80 traffic that direct it to your eth0/0. Than only port 80 traffic wil follow that route and all other ports will go over the adsl line

 I think that it would become something like:

set access-list extended 20 src-ip 10.0.4.0/24 dst-port 80-80 protocol any entry 3
set match-group name Imagine
set match-group Imagine ext-acl 20 match-entry 1
set action-group name Imagine
set action-group Imagine next-hop 83.XXX.XXx.65 action-entry 1
set pbr policy name Outbound_PBR
set pbr policy Outbound_PBR match-group Imagine action-group Imagine 2
exit
set interface bgroup0 pbr Outbound_PBR

hope this helps 

-Tim

Hi Tica,

Thanks for the response, sorry for the delay in getting back, major ISP issues over the weekend. So from your exapmle cod i should set the action group to use the next hop, should i not use the outbound interface? set action-group Imagine next-hop 83.XXX.XXx.65 action-entry 1. Where is the best place to apply the policy to the interface, zone or VR.

thanks

Alan

No problem,

My experiance is that is is better to use a next hop. The ssg will determin the outbound interface itself (via the routing table).

Depends what you want. Normally I would keep it interface based. 

I would use zone based if you have multiple interfaces in a zone and they all should follow that PBR

Vrouter based  is best used when you have several routes that should follow the same PBR

-Tim

Thanks a million Tim, I have changed it to Next Hop this morning and its working perfectly.

Alan