Is it possible on Juniper or Cisco to configure PBR where it matches on an ingress interface AND a source IP address?

My scenario traffic flows are as follows:

Router1 > Router2 > WAN_Optimiser > Router2 > Firewall > Router2 > Router3

Both the WAN Optimiser and Firewall are in transparent mode and sit connected off Router2 on a single interface each.

I need to be able to have traffic come into router2, be directed to the WAN Optimiser, return to Router2, then be directed to the firewall, then be returned to Router2, before being router to its intended destination.

The rules would look something like for outgoing traffic


Rule 1

match interface <interface connected to router1>
match ip range
then send to <interface connected to wan_opt>

Rule 2

match interface <interface connected to wan_opt>
match ip range
then send to <interface connected to firewall>

Putting aside the wisdom of your traffic flow scenario, you can accomplish this on a Cisco device as well.

Policy-based routing is applied to an incoming interface, so you will have three different policies -- each applied to a different interface. For example:

ip access-list standard PBR-DEMO

route-map FROM-R1 permit 10
match ip address  PBR-DEMO
set ip next-hop <Wan optimizer>

route-map FROM-OPT permit 10
match ip address PBR-DEMO
set ip next-hop <Firewall>

route-map FROM-FW permit 10
match ip address  PBR-DEMO
set ip next-hop <router-3>

interface <router 1>
ip policy route-map FROM-R1

interface <Wan optimizer>
ip policy route-map FROM-OPT

interface <firewall>
ip policy route-map FROM-FW
  • Thanks for your answer. And totally agree the traffic flows are not idea, thankfully its only setup this way so I can test a few things that will be virtualised but physical in production where I just just easily put them inline. – Dylan Nov 15 '20 at 10:14

Neither way policy based routing can applyed for both inbound and outbound traffic in cisco and juniper firewalls

For outbound traffic

When user want to access resources in internet and wants to use specific ISPs connectivity when two or more ISP or connected for firewall. This policy based routing will ensure traffic is diverted to selected ISP when multiple ISP links are present . Generally PBR is configured with specific source ip address and destination address exist interface and gateway of exist interface . Same as for inbound traffic basically policy based routing has priority then normal routing . Firewalls will first check policy based routing table to forward traffic then after it will check normal routing table...


PBR in Juniper land is called Filter Based Forwarding. FBF uses ingress firewall filters to match and move traffic into a forwarding routing instance. What you could do here assuming you're on a MX or SRX platform, is apply an ingress filter to your source interface like so:

  • Firstly you need to create a routing instance to forward the traffic into (This instance should hold a default route towards your WAN Optimiser)
set routing-instance WAN-OP instance-type forwarding 

(You will also need to create a rib-group or instance-import statement to import/export interfaces to the instance RIB/default RIB)

  • Create a firewall filter to match your traffic (Because we're applying this filter to a single ingress interface we are only matching traffic from this interface)
set firewall family inet filter FORWARD-TO-WAN-OP term 1 from source-address
set firewall family inet filter FORWARD-TO-WAN-OP term 1 then routing-instance WAN-OP
  • Apply your filter to the ingress interface
set interfaces xxxx unit xxx family inet filter input FORWARD-TO-WAN-OP

Now, when traffic enters that logicial interface with a source of, traffic will be moved from inet.0 into the WAN-OP.inet.0 RIB to follow the instances routing table.

Your WAN Optimiser can then return traffic back to the same Junos device to follow the default route in inet.0. Just ensure the traffic returns back from the WAN Optimiser on a logicial interface that doesn't contain our newly created filter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.