Inbound NAT Policy with Outbound PBF Causing IP-Spoofing Drops

Issue

If a Policy Based Forwarding (PBF) rule is setup to route inside traffic out a primary interface and the backup default route is configured in the VR with an interface, the return traffic (which is picked up by PBF Policy) may be blocked if the Spoofed IP protection option is selected on the Zone Protection Profile.

Resolution

Remove the interface in the default route (it is not a necessary option)

owner: dburns