Specify PBR across multiple VLans to a specific WAN

[TheGoob]

Hello

I will more generalize my system to get across the idea better.

DSL Modem - FPR1010 - SG350XG.

All ACL/NAT is done on FPR with a static route to find the 3 VLans on the SG350XG. [FPR 1/2 connects to SG 1/1]

On SG I have 3 VLans and each VLan is, by NAT, associated with it's own WAN IP going back to the FPR.

Currently, everything works as IS.

ENTER, I have a OpenVPN Router with a different ISP that connects to SG 1/2. It is connected 24/7 and with a killswitch to a VPN for private browsing. My goal is to have host on each VLan use it's associated WAN IP EXCEPT I want any host on any VLan to use SG 1/2 [VPN] for HTTP/HTTPS traffic. 

1. Create an ACL called 'HTTP', Permit, TCP, Any, Any, 80

2. Create a Route Map called 'PBR_HTTP', match ip address, select HTTP ACL, next hop [VPN Router IP]

3. Apply Route Map, Select Interface [1/2 as that connects to VPN Router], Select PBR and apply 'PBR_HTTP'.

Would this be sufficient? Will this cause each of the VLans to use the intended PBR? And of course, I need to do this for HTTPS as well.

[balaji.bandi]

I am sure SG350 support PBR (I guess so).

Follow the video below for PBR - high level, your plan should work, but make sure you correct the routing in place to work for return traffic.

https://video.cisco.com/detail/video/5848099081001?autoStart=true&q=PBR

[TheGoob]

Interesting, by the looks of this Video, I would not do an ACL but just tell traffic from specific vlan to specific Next Hop.

[Giuseppe Larosa]

Hello @TheGoob ,

PBR works inbound so you need to apply it on each of three SVI ( interface VLAN) defined on the switch.

The OpenVPN router needs to be configured for NAT too if you want to have internal hosts to access web sites on the public internet via the VPN device.

Hope to help

Giuseppe

[TheGoob]

When you say apply to each vlan, you refer to any vlan in need of the PBR? Also that makes sense, I would need to create a route back to the SG.