topic Re: FTD PBR Question in Network Security

FTD PBR Question

benolyndav — Wed, 18 Feb 2026 12:46:43 GMT

I have been labbing this up and have come to the conclusion that when using FTD PBR a default route is still required, I have tried everything and without a default route traffic is routed via an interface not stipulated as (egress interface) in the PBR policy

Does this sound correct or am I doing something wrong please.??

Thanks

Re: FTD PBR Question

Rob Ingram — Wed, 18 Feb 2026 12:53:54 GMT

@benolyndav in the past I had a default route for normal traffic via ISP1, then used PBR to match explict traffic a route that via a different interface (ISP2) - that worked fine. Example

If you run packet-tracer from the CLI, that should do a pbr lookup and provide a clue, or at least confirm if pbr is doing something.

Re: FTD PBR Question

benolyndav — Wed, 18 Feb 2026 13:11:38 GMT

@Rob Ingram The problem is we already have a default route pointing to another next hop, I tried this placing the destination interface in a user defined vrf and added a default route and it worked so default in vrf and default in global, do you think this is the only way I can achieve my requirement using (vrf)

Thanks

Re: FTD PBR Question

Rob Ingram — Wed, 18 Feb 2026 13:21:14 GMT

@benolyndav looks like PBR only works with the global virtual router only.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/100/management-center-device-config-10-0/routing-vrf.html

Re: FTD PBR Question

benolyndav — Wed, 18 Feb 2026 13:24:48 GMT

@Rob Ingram the Destination interface is in the vrf and not the source interface which is ok according to Cisco docs and packet-tracer looks ok too.?

Re: FTD PBR Question

Rob Ingram — Thu, 19 Feb 2026 12:24:35 GMT

@benolyndav sorry, I've not tried that scenario, I'd have to lab it to confirm either way.