PBR on VPN 100

Cheisie Lv1Posted Oct-08-2025 09:49

Last edited by Cheisie Oct-08-2025 10:37.

Hello, I would like to use the existing topology as follows:
With the following information:

NSF 1 (Headquarter):
WAN A (Primary): 1.1.1.1
WAN B (Secondary): 2.2.2.2

NSF 2 (Branch):
WAN C (Primary): 3.3.3.3
WAN D (Secondary): 4.4.4.4

I have successfully connected both NSF devices using Sangfor VPN, and it is working fine. However, when I enable Policy-Based Routing (PBR) on both sides, the VPN connection suddenly disconnects. I would like each site’s VPN to use the primary WAN as the main internet source.

If WAN 1 is disconnected and replaced by WAN 2, the connection will switch to WAN 2. However, when WAN 1 is reconnected, I would like the connection to switch back to WAN 1.

Is there any specific configuration required to make this feature work properly?
Thank you.

By solving this question, you may help 961 user(s).

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins, 100 coins of bounty and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

Newbie337989 Lv2Posted Oct-08-2025 09:55
  
Hi,

Correct me here if wrong.

When you enable PBR, the firewall starts forwarding packets strictly according to your defined policy routes, instead of following the default route table.
If the VPN traffic (IKE / IPsec) is not explicitly allowed to use the correct WAN interface, the tunnel negotiation packets (UDP 500 / 4500 and ESP) may be redirected incorrectly > resulting in disconnection.

Try this.

1. Exclude VPN traffic from PBR
- You must ensure that VPN negotiation and tunnel traffic are not affected by policy routes.
- Go to Network > Policy Route
- At the top of the list, add an exception rule:
  - Source IP: Local WAN IP (e.g., 1.1.1.1 or 2.2.2.2)
  - Destination IP: Remote WAN IP (e.g., 3.3.3.3 or 4.4.4.4)
  - Service: IPsec / IKE (UDP 500, UDP 4500, ESP)
  - Action: Route via correct WAN interface (e.g., WAN A → WAN C)
- This ensures all VPN negotiation packets go through the intended primary WAN.

2. Bind the VPN to a specific WAN
- When editing your IPsec / VPN configuration, check the option for “Specify outgoing interface” or “Bind WAN interface”.
- Select WAN A for NSF1 and WAN C for NSF2.
- This ensures the tunnel always negotiates via the primary WAN, even if other WANs exist.

3. Add fallback behavior (optional)
- If you want the VPN to automatically switch to the secondary WANs (2.2.2.2 / 4.4.4.4) when the primary fails:
- Enable VPN link redundancy or Dual-WAN failover.
- Then, under PBR rules, use a condition such as:
- If WAN A down > route VPN to WAN B
- You can achieve this by enabling “Detect Interface Status” in your PBR settings.

I Can Help:

Change

Moderator on This Board

1
148
3

Started Topics

Followers

Follow

917
183
94

Started Topics

Followers

Follow

Board Leaders