Configure a Policy Based Forwarding Rule

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationNGFW and Prisma AccessNetwork ServicesPolicy Based Forwarding and select the Configuration Scope where you want to configure the PBF rule.
   You can select a folder or firewall from your Folders or select Snippets to configure the PBF rule in a snippet.
3. Add Rule.
4. Enter a descriptive Name for the PBF rule.
5. (Optional) Enter a Description for the PBF rule.
6. Select the PBF rule Position.
   • Pre-Rule—Policy rule is added to the top of the rule order and evaluated head of any locally defined policy rules and post-rules.
     If no position is selected, the PBF rule is created as a pre-rule by default.
   • Post-Rule—Policy rule is added to the bottom of the rule order and evaluated after the pre-rules and locally defined rules.
7. (Optional) To trigger the specified forwarding Action at a daily, weekly, or nonrecurring frequency, select or create a Schedule.
8. Configure the traffic Source.
   1. Select the source Type to which you’ll apply the forwarding policy rule.
      • Zones— Add Zones and select a zone.
      • Interface—Add Interface and select a Layer 3 interface.
        Only Layer 3 interfaces are supported; loopback interfaces don’t support PBF.

        To enforce symmetric return, you must select a source interface.
   2. Specify the source Addresses to which the PBF policy rule applies.
      Individual addresses, address groups, or external dynamic lists (EDL) are supported as source addresses. A PBF policy rule is configured to apply to Any Address by default.

      Click Negate to exclude one or more source addresses from the PBF rule.
   3. Specify the source Users to whom the policy rule applies.
      Individual users or user groups as source users. A PBF policy rule is configured to apply to Any User by default.

      Click Negate to exclude one or more source users from the PBF rule.
9. Configure the traffic Destination Addresses to which the PBF policy rule applies.
   Individual addresses, address groups, or external dynamic lists (EDL) are supported as destination addresses. A PBF policy rule is configured to apply to Any Address by default.

   Click Negate to exclude one or more destination addresses from the PBF rule.
10. Select the Applications and Services that you want to control using PBF.
    • (Optional) Add Applications to add one or more applications to control. Any Application is selected by default if you don’t add any applications.
      Palo Alto Networks doesn’t recommend application-specific rules for use with PBF. PBF rules might be applied before the firewall has enough information to determine the application. Whenever possible, use a service object, which is a Layer 4 port (TCP or UDP) used by the protocol or application. For more details, see Service Versus Applications in PBF.
    • Add Services to add one or more services to control. You can also Add Service Groups to add multiple services as a single service entity. Any Services is selected by default if you don’t add any services or service groups.
11. Define the Forwarding action and network information for packets that match the PBF policy rule.
    1. Select the Action to take when matching a packet.
       • Forward (default)—Directs packet to the specified Egress Interface.
       • Discard—Drops the packet.
       • No PBF—Excludes the packets that match the criteria for source, destination, application, or service defined in the rule. Matching packets use the route table instead of PBF; the firewall uses the route table to exclude the matched traffic from the redirected port.
    2. (Forward only) Select the Egress Interface to forward matching packets to.
    3. (Forward only) Select the Next Hop.
       • None (default)—The destination IP address of the packet is used as the next hop. Forwarding fails if the destination IP address isn’t in the same subnet as the egress interface.
       • IP Address—Enter an IP address or select an address object of type Ip Netmask to which the firewall forwards matching packets. An IPv4 address object must have a /32 netmask.
       • FQDN—Enter an FQDN or select or create an address object of type FQDN to which the firewall forwards matching packets. The FQDN must resolve to an IPv4 address.
         This FQDN must resolve to an IP address that belongs to the same subnet as the interface you configured for PBF; otherwise, the firewall rejects the resolution and the FQDN remains unresolved.
    4. (Optional; Forward only) Enable Monitor to verify connectivity to a target IP address or to the Next Hop IP address if no IP address is specified.
       1. Select a monitoring Profile or Create New to specify the action when the monitored address is unreachable.
       2. You can Disable this rule if nexthop/monitor ip is unreachable.
       3. Enter a target IP Address to monitor.
    5. (Required for asymmetric routing environments; Optional otherwise) Enforce Symmetric Return and Add or more IP address in the Next Hop Address List.
       You can add up to eight next-hop IP addresses. Tunnel and PPoE interfaces are not supported as a next-hop IP address.
12. Save.
13. Push Config to push your configuration changes.