Step 1

Choose Devices > Device Management, and edit the threat defense device.

Step 2

Click Routing.

Step 3

Click Policy Based Routing.

Step 4

To configure the policy, click Add.

Step 5

In the Add Policy Based Route dialog box, select the Ingress Interface from the drop-down list.

Step 6

To specify the match criteria and the forward action in the policy, click Add.

Step 7

In the Add Forwarding Actions dialog box, do the following:

1. From the Match ACL drop-down, choose the extended access control list object. You can predefine the ACL object (see Configure Extended ACL Objects) or click the Add () icon to create the object. In the New Extended Access List Object box, enter a name, click Add to open the Add Extended Access List Entry dialog box, where you can define the network, port, user identity, SGT, or application match criteria for the PBR policy.

   Note

   You can either have destination address or application/user identity/SGT defined in an ACE. To selectively apply PBR on the incoming interface, you can define Block criteria in the ACE. When the traffic matches the block rule of the ACE, the traffic is forwarded to the egress interface based on the routing table.

2. From the Send To drop-down list:

   • To select the configured interfaces, choose Egress Interfaces.

   • To specify the IPv4/IPv6 next hop addresses, choose IP Address. Proceed to Step 7.e

3. If you have selected Egress Interfaces, from the Interface Ordering drop-down, choose the relevant option:

   • By Interface Priority—The traffic is forwarded based on the priority of the interfaces. Traffic is routed to the interface with the least priority value first. When the interface is not available, the traffic is then forwarded to the interface with the next lowest priority value. For example, let us assume that Gig0/1, Gig0/2, and Gig0/3 are configured with priority values 0,1, and 2 respectively. The traffic is forwarded to Gig0/1. If Gig0/1 becomes unavailable, the traffic is then forwarded to Gig0/2.

     Note

     To configure the priority for the interfaces, click Configure Interface Priority on the Policy Based Routing page. In the dialog box, provide the priority number against the interfaces, and then click Save. You can also configure the priority for an interface in the Interface Settings. When the priority value is the same for all the interfaces, the traffic is balanced among the interfaces.

   • By Order—The traffic is forwarded based on the sequence of the interfaces specified here. For example, let us assume that Gig0/1, Gig0/2, and Gig0/3 are selected in the following order, Gig0/2, Gig0/3, Gig0/1. The traffic is forwarded to Gig0/2 first, then to Gig0/3, irrespective of their priority values.

   • By Minimal Jitter—The traffic is forwarded to the interface that has the lowest jitter value. You need to enable Path Monitoring on the interfaces for PBR to obtain the jitter values.

   • By Maximum Mean Opinion Score—The traffic is forwarded to the interface that has the maximum mean opinion score (MOS). You need to enable Path Monitoring on the interfaces for PBR to obtain the MOS values.

   • By Minimal Round Trip Time—The traffic is forwarded to the interface that has the minimal round trip time (RTT). You need to enable Path Monitoring on the interfaces for PBR to obtain the RTT values.

   • By Minimal Packet Loss—The traffic is forwarded to the interface that has the minimal packet loss. You need to enable Path Monitoring on the interfaces for PBR to obtain the packet loss values.

4. In the Available Interfaces box, all the interfaces with their priority values are listed. From the list of interfaces, click the Add () button to add to the selected egress interfaces. Proceed to Step 7.k

5. If you have selected IP Address, enter the IP addresses separated by commas in the IPv4 Addresses or IPv6 Addresses fields. The traffic is forwarded as per the sequence of the specified IP addresses.

   Note	When multiple next-hop IP addresses are provided, the traffic is forwarded as per the sequence of the specified IP addresses until a valid routable next-hop IP address is found. The configured next-hops should be directly connected.

6. From the Don't Fragment drop-down list, select Yes, No, or None. If the DF (Don't Fragment) flag is set to Yes, the intermediate routers never perform fragmentation of a packet.

7. To specify the current interface as the default for forwarding, check the Default Interface check box.

8. The IPv4 Settings and IPv6 Settings tab enables you to specify the recursive and default settings:

   Note	For a route-map, you can only specify either IPv4 or IPv6 next-hop settings.

   • Recursive—The route map configuration is applied only when the specified next-hop address and the default next-hop address are found on a directly connected subnet. However, you could use the recursive option, where the next-hop address need not be directly connected. Here, a recursive lookup is performed on the next-hop address, and matching traffic is forwarded to the next-hop used by that route entry according to the current routing path of the router.

   • Default—If the normal route lookup fails to match traffic, the traffic is forwarded to this specified next-hop IP address.

9. Check the Peer Address check box to use the next-hop address as the peer address.

   Note	You cannot configure a route map with both default next-hop address and peer address.

10. For IPv4 settings, you can check whether the next IPv4 hops of a route map are available under Verify Availability—click the Add () button and add the next-hop IP address entries:

    • IP Address—Enter the next hop IP address.

    • Sequence—Entries are assessed in order using the sequence number. Ensure that no duplicate sequence numbers are entered. The valid range is 1 to 65535.

    • Track—Enter a valid ID. The valid range is 1 to 255.

11. Click Save.

Step 8

To save the policy, click Save and Deploy.

Step 1

Configure policy based routing for the branch threat defense, select the ingress interfaces:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Choose Routing > Policy Based Routing, and on the Policy Based Routing page, click Add.

3. In the Add Policy Based Route dialog box, select the interfaces (say, Inside 1, and Inside 2) from the Ingress Interface drop-down list.

Step 2

Specify the match criteria:

1. Click Add.

2. To define the match criteria, click the Add () button.

3. In New Extended Access List Object, enter the name for the ACL (say, DIA-FTD-Branch), and click Add.

4. In the Add Extended Access List Entry dialog box, choose the required web-based applications from the Application tab:

   

   On the threat defense, the application group in an ACL is configured as a network service group and each of the applications as a network service object.

   

5. Click Save.

6. Select DIA-FTD-Branch from the Match ACL drop-down list.

Step 3

Specify the egress interfaces:

1. From the Send To and Interface Ordering drop-down lists, choose Egress Interfaces, and By Priority respectively.

2. Under Available Interfaces, click the button against the respective interface names to add WAN1 and WAN2:

   

3. Click Save.

Step 4

Interface priority configuration:

1. Choose Devices > Device Management, and edit the branch threat defense.

2. Set the priority for the interfaces. Click Edit against the interface and enter the priority value:

   

3. Click Ok and Save.

Step 5

Create ECMP zones for load balancing:

1. In the Routing page, click ECMP.

2. To associate interfaces to the ECMP zone, click Add.

3. Select WAN1 and WAN 2 and create an ECMP zone—ECMP-WAN. Similarly, add VTI01 and VTI02 and create an ECMP zone—ECMP-VTI:

   

Step 6

Configure static routes for the zone interfaces for load balancing:

1. In the Routing page, click Static Route.

2. Click Add and specify the static routes for WAN1, WAN2, VTI01, and VTI02. Ensure that you specify the same metric value for the interfaces belonging to the same ECMP zones (Step 5):

   

   Note	Ensure that the zone interfaces have the same destination address and metric, but different gateway addresses.

Step 7

Configure trusted DNS on the WAN objects of the branch threat defense to ensure secured flow of traffic to the internet:

1. Choose Devices > Platform Settings, and create a DNS policy on the branch threat defense.

2. To specify the trusted DNS, Edit the policy and click DNS.

3. To specify the DNS servers for the DNS resolution to be used by WAN objects, in the DNS Settings tab, provide the DNS server group details and select WAN from the interface objects.

4. Use the Trusted DNS Servers tab to provide specific DNS servers that you trust for the DNS resolution.

Step 8

Save and Deploy.

Step 1

Path monitoring configuration on interfaces ISP01, ISP02, and ISP03:

1. Choose Devices > Device Management, and edit threat defense.

2. Under the Interfaces tab, edit the interface (in our example, ISP01)

3. Click the Path Monitoring tab, select the Enable Path Monitoring check box, and then specify the monitoring type (see Configure Path Monitoring Settings).

4. Click Ok and Save.

5. Repeat the same steps and configure the path monitoring settings for ISP02 and ISP03.

Step 2

Configure policy-based routing for a branch in an organization threat defense, select the ingress interfaces:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Choose Routing > Policy Based Routing, and on the Policy Based Routing page, click Add.

3. In the Add Policy Based Route dialog box, select Inside 1 from the Ingress Interface drop-down list.

Step 3

Specify the match criteria:

1. Click Add.

2. To define the match criteria, click the Add () button.

3. In New Extended Access List Object, enter the name for the ACL (example, PBR-WebEx), and click Add.

4. In the Add Extended Access List Entry dialog box, choose the required web-based applications (example, WebEx Meetings) from the Application tab.

   Remember

   On threat defense, the application group in an ACL is configured as a network service group and each of the applications as a network service object.

5. Click Save.

6. Select PBR-WebEx from the Match ACL drop-down list.

Step 4

Specify the egress interfaces:

1. From the Send To drop-down list, choose Egress Interfaces.

2. From the Interface Ordering drop-down list, choose By Minimal Jitter.

3. Under Available Interfaces, click the Right Arrow ()button against the respective interface names to add ISP01, ISP02, and ISP03.

4. Click Save.

Step 5

Repeat Step 2 and Step 3 to create PBRs for the same interface (Inside1) to route Office365 and network-based access control traffic:

1. Create a match criteria object, example PBR-Office365, and select the Office365 application from the Application tab.

2. From the Interface Ordering drop-down list, choose By Minimal Round Trip Time.

3. Specify the egress interfaces ISP01, ISP02, and ISP03, and click Save.

4. Now, create a match criteria object, example PBR-networks, and specify the source and destination interface in the Network tab.

5. From the Interface Ordering drop-down list, choose By Minimal Packet Loss.

6. Specify the egress interfaces ISP01, ISP02, and ISP03, and click Save.

Step 6

Save and Deploy.

Step 7

To view path monitoring metrics, choose Devices > Device Management, and from More () click Health Monitor. To view the metric details for the interfaces of the device, you must add the path metrics dashboard. For details, see Add Path Monitoring Dashboard.