Policy routing with remote gateways

[senseivita]

This might involve a routing package. It does, but for the sake of routing; the route is already known to the firewall.

Hi !

I'll use this as reference:

I have a couple of routes towards 0/0 obtained through OSPF on a remote router (WZ2, WZ3). For incoming traffic from the public network, things sort themselves out thanks to OSPF. There is no NAT internally, only on the public interfaces (symbolized by the little doors above.)

My question is, [1] how can I use policy routing with the routes learned from a protocol? These gateways aren't available for policy routing.

Currently what I do is manually add the gateway so it becomes selectable, otherwise I wouldn't know how. I think that protocol-learned gateways are considered ephemeral or something.

The second aspect of this is remote multi-WAN, my current approach to that — or the most recent one since it's mostly hypothetical right now — is to use virtual IP addresses each mapped to a gateway or to an interface rather, since the gateway may be shared.

Alternatively, use source-based policy routing on the remote router where the sources would be also virtual IP addresses but this time on the downstream routers and NAT to disguise the traffic. It works too but it's a lot less practical than VIPs on the upstream.

[2] Is there a more straightforward to do PBR from an internal router?

On second thought, I just remembered VIPs set on any router are passed around by OSPF, so I really just need the answer to 1, if there's one.

If you have any extra tips/comments that welcome too!