Handling Process
1. Use internal PC access public network and check conversation:
tcp VPN:public --> public Zone: trust--> untrust1 TTL: 00:00:05 Left: 00:00:00
Interface: Dialer2 NextHop: 0.0.0.0 MAC: 00-00-00-00-00-00
<--packets:0 bytes:0 -->packets:1 bytes:48
192.168.1.248:53469[0.0.0.0:2143]-->112.95.240.11:443
http VPN:public --> public
Zone: trust--> untrust1 TTL: 00:00:05 Left: 00:00:00
Interface: Dialer2 NextHop: 0.0.0.0 MAC: 00-00-00-00-00-00
<--packets:0 bytes:0 -->packets:1 bytes:48
192.168.1.248:53470[0.0.0.0:2174]-->112.95.240.11:80
Packet still go out from dialer interface, policy-based routing is also function, but the interface is down ,so switch address is 0.0.0.0.
And switch fail.
2. Physical interface is down but dialer interface is still up when it is multi-exit interface, policy-based routing is working. We must configure ip-link check to make sure interface switch successfully. Or change the policy-based routing;
policy-based-route 2 permit node 1
if-match acl 2000
apply output-interface Dialer2
Root Cause
1. Configuration problem
2. Product characteristic
3. other
Solution
Suggestions
none