top of page
Search

Palo Alto PBF Ignored: test pbf-policy-match When Default Route Wins Anyway

  • 3 days ago
  • 2 min read
Palo Alto network security troubleshooting lab
Palo Alto · Techclick CLI troubleshooting lab
Guest Wi-Fi should exit ISP-B. Traceroute still leaves via ISP-A. PBF rule looks enabled.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Palo Alto for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Policy Based Forwarding is a first lookup. If test pbf-policy-match misses, the virtual router default route wins. Check source zone, enforce symmetric return, and next-hop liveliness.

Why this ticket shows up

PBF only matches what you wrote. A wrong source zone, a down monitor IP, or missing symmetric return sends packets back to the VR.

Symptoms operators actually see

  • PBF rule is on, traceroute still uses the default ISP

  • Works when you source-nat from the firewall

  • Monitor IP for ISP-B is down

  • Return traffic arrives on the other ISP

CLI first — copy this block

Run these on the Palo Alto device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

test pbf-policy-match from guest source 10.80.0.25 destination 8.8.8.8 destination-port 53 protocol 17
show running pbf-policy
show routing fib
show pbf rule all
ping source <isp-b-ip> host 8.8.8.8

How to read that output

The test must name your PBF rule and the ISP-B egress. If it says no match, the VR owns the packet. A red monitor on the PBF rule means the next-hop was declared dead.

Triage order

  1. Run test pbf-policy-match with a real guest IP.

  2. If no match, fix zone/source/service on the PBF rule.

  3. If it matches but monitor is down, fix the monitor IP.

  4. Enable Enforce Symmetric Return if the return path is asymmetric.

  5. Traceroute from the guest, not from the firewall.

Classic traps

What you see

Real cause

Fix

Change the default route

PBF should have won

Fix the PBF match

Ping from the firewall

Firewall is not in guest zone

Test from a guest client

Next-hop is up

Monitor IP is a blocked anycast

Monitor a real reliable IP

Proof the ticket is closed

  • PBF test hits the named rule

  • Guest traceroute leaves ISP-B

  • Monitor is green

Say this in an interview

I prove PBF with test pbf-policy-match. If it misses, I do not touch the static default.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page