I have a situation I am working out a solution for that I thought I understood but am not sure where it goes wrong; if the issue is upstream and I know no one can answer that in this forum without more info on the network side, but I will define the requirements I am needing and the method I am using. Please tell me if I am seeing this incorrectly if there is an easier way, or whatever critiques may be part of the end goal. I am always open and willing to learn a new method for handling this situation. I have a VPX with three interfaces attached: all-access ports, no tagging needed. I Have an mgmt network with an NSIP and SNIP, using a PBR to point the traffic to the mgmt gateway on 0/1. For the other two access interfaces, I aim to create two Citrix Gateway vServers for SSLVPN with Intranet IPs being handed out. I assigned VLANs 111 with an SNIP to 1/1 and 222 with an SNIP 1/2 for each, and I have a VIP for each and a pool of Intranet IPs in the same network. I have tried PBRs with those, but there is an order of operations where I cannot create a direct route if I don’t have a direct route. I also cannot hand out an intranet IP within the range of the SNIP, but the gateway is outside that, which is functional, I think. My question is this: am I overcomplicating this? The TL: DR - VPX has three access ports with PBRS sending traffic back out the same interface gateway. Intranet IPs are used and tied to Citrix Gateway VIP, with the PBRs applied. MBF is enabled Layer 3 mode is enabled Default route - not sure yet Network 1 NSIP - PBR Network 2 - DMZ1 - VLAN 111 - PBR Network 3 - DMZ2 - VLAN 222 - PBR

MAC based forwarding and Policy Based Routes are going to conflict. I need to refresh my memory, but I believe MBF is going to take precedence. Are you experiencing routing issues?

I am - and I was thinking it might be the best approach to turn MBF off - I wanted another opinion. Thanks! I will suggest we try that.

Definitely disable MBF, the RFC for MBF and traditional L3 routing work against each other. PBR actually solves the same problem as MBF, but you have to configure explicitly what you want and how you want it (if your default routes are not enough). That is also the reason why you configure your PBR for management, to override the default route.

1 interface per VLAN rather than LCAP with trunk is not ideal. You have no resiliency, no? As other said, MBF hide routing issue, avoid it. Having to use PBR for mgt int, etc may just be about the overall routing design which is more a network design. Usually you have the Edge FW with 0.0.0.0 default and then specific route going through your internal FW.

I agree - I was lifting and shifting and started life off without the MBF enabled and had issues because the tribal knowledge in the network is gone; I don't know what is happening beyond it. I will take the approach of reeling back into the no MBF, no layer 3, and pure PBR per VLAN/interface . Thanks!