2.3 Policy-Based Forwarding (PBF) and Path Monitoring

2.3 Policy-Based Forwarding (PBF) and Path Monitoring

Standard IP routing relies on destination-based forwarding: a router or firewall inspects the destination IP address of an incoming packet, looks up the longest matching prefix in its Forwarding Information Base (FIB), and forwards the packet out the associated egress interface.

However, modern enterprise networks often require traffic forwarding decisions based on additional attributes—such as the source subnet, the specific App-ID application (e.g., Office365 vs. general web browsing), the service port, or the User-ID user group. Palo Alto Networks PAN-OS addresses these requirements through Policy-Based Forwarding (PBF) and Path Monitoring.

---

PBF Rules vs. Virtual Router Routing Table

In the PAN-OS packet processing architecture, PBF rules are evaluated BEFORE standard Virtual Router routing table lookups:

[Ingress Packet] 
       │
       ▼
[PBF Rule Lookup] ──(Match Found?)──► [YES] ──► [Override Egress Interface & Next-Hop]
       │                                                      │
     [NO]                                                     │
       ▼                                                      ▼
[Virtual Router FIB Lookup] ◄──────────────(PBF Inactive/Fallback)

If a packet matches an active PBF rule, PAN-OS bypasses the Virtual Router's FIB destination lookup and forwards the packet directly to the egress interface and next-hop IP specified in the PBF rule.

If no PBF rule matches (or if the matching PBF rule is currently disabled/inactive due to Path Monitoring failure), traffic falls back to standard Virtual Router FIB forwarding.

---

PBF Rule Matching Criteria & Actions

A PBF rule specifies detailed match parameters and an associated forwarding action:

Matching Criteria

• Source: Source Zone, Source Interface, Source IP Address / Subnet.
• Destination: Destination IP Address / Subnet.
• Application (App-ID): Specific applications (e.g., salesforce, zoom, webex-base).
• Service: Port and protocol definitions (e.g., service-http, service-https, or custom TCP/UDP ports).
• User / User-ID: Specific user names or Active Directory security groups.

PBF Actions

Engineering Use Case: Use No PBF as an early rule in the PBF rulebase to exempt internal subnet-to-subnet traffic from being hijacked by a lower-priority internet breakout PBF rule.

---

Path Monitoring Profiles & Probes

A critical risk with static forwarding rules is "blackholing" traffic: if a PBF rule forces traffic out ethernet1/1 to an ISP gateway, but the ISP upstream link fails while the firewall's physical port stays UP, traffic sent via PBF will be lost.

PAN-OS eliminates blackholing through Path Monitoring.

Path Monitoring Mechanics

Path Monitoring attaches active health probes to a PBF rule to continuously verify the viability of the remote path:

1. Probe Types:
   • ICMP Ping: Sends periodic ICMP echo requests to target IP addresses (e.g., ISP gateway 203.0.113.1 or public DNS 8.8.8.8).
   • HTTP GET: Sends HTTP GET requests to web servers to verify Layer 7 service reachability.
2. Monitoring Parameters:
   • Ping Interval: Time between probes (default = $1$ second).
   • Ping Retries: Number of consecutive missed responses before marking a target dead (default = $3$).
3. Failure Conditions:
   • Any: Path is declared failed if at least one monitored IP target stops responding.
   • All: Path is declared failed only if all monitored IP targets stop responding.

---

Automatic Failover and Fallback Behavior

When Path Monitoring detects that a monitored path has failed:

1. Dynamic Deactivation: PAN-OS immediately transitions the PBF rule state from Active to Disabled / Inactive.
2. Automatic FIB Fallback: Subsequent traffic matching the PBF rule automatically bypasses the disabled rule and falls back to the Virtual Router's standard Routing Table (FIB).
3. Automatic Recovery: Path Monitoring continues probing in the background. When target IPs respond successfully, PAN-OS automatically reactivates the PBF rule, restoring the policy-based path.

[Path Monitoring Probes Active]
       │
       ├─► [Probes Succeed] ──► PBF Rule Status: ACTIVE   ──► Traffic uses PBF Egress/Next-Hop
       │
       └─► [Probes Fail]    ──► PBF Rule Status: INACTIVE ──► Traffic falls back to Virtual Router FIB

---

Enforcing Symmetric Return Forwarding

When PBF redirects asymmetric traffic flows, return packets arriving from external networks might be dropped by stateful inspection if they enter a different interface.

Enabling Enforce Symmetric Return on a PBF rule instructs PAN-OS to store the ingress interface of the initial packet in the session table. All return traffic for that session is automatically routed back out the exact same interface, preserving stateful security inspection across dual-homed ISP connections.