Next-Generation Firewall
Configure a Static Route
Table of Contents
Configure a Static Route
Configure a static route to route Layer 3 traffic.
Contact your account team to enable Cloud Management for NGFWs using
Strata Cloud Manager.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
One of these:
|
Configure a static route for your logical router to configure Layer
3 traffic to take a certain route without participating in IP routing protocols. A
default route is a specific static route. If you don’t use dynamic routing to obtain
a default route for your logical router, you must configure a static default route.
When the logical router has an incoming packet and finds no match for the packet
destination in its route table, the logical router sends the packet to the default
route. The default IPv4 route is 0.0.0.0/0; only a IPv4 default route is
supported.
By default,
static routes have an administrative distance of 10. When the firewall
has two or more routes to the same destination, it uses the route
with the lowest administrative distance. By increasing the administrative
distance of a static route to a value higher than a dynamic route,
you can use the static route as a backup route if the dynamic route
is unavailable.
While you’re configuring a static route, you can specify whether the firewall installs an IPv4
static route in the unicast or multicast route table (RIB), or both tables, or
doesn’t install the route at all. For example, you could install an IPv4 static
route in the multicast route table only, because you want only multicast traffic to
use that route. This option gives you more control over which route the traffic
takes.
- Log in to Strata Cloud Manager.Configure a Layer 3 Interface.Configure a Logical Router.Select and select the Configuration Scope where you want to create the static route.You can select a folder or firewall from your Folders or select Snippets to configure the static route in a snippet.Add Router.Enter a descriptive Name.A maximum of 63 characters are supported. The name must start with an alphanumeric character and can contain a combination of alphanumeric characters, underscore (_), hyphen (-), dot (.), and space.(Optional) Add an Interface to specify the outgoing interface for packets to use to go to the next hop.Use this for stricter control of which interface the firewall uses rather than the interface in the route table for the next hop of this route.Edit the Static IPv4 Static Routes.Add Static Route to specify the next hop.Configure the static route.
- Enter a Name for the static route.For the Destination, enter the IP address for the route destination.For the Next Hop, select one of the following.
- Discard(default)—Select to drop packets that are addressed to the destination.
- IP Address—Enter the IP address when you want to route to a specific next hop.
(IP Address Next Hop only) Configure the next hop IP Address.(IP Address Next Hop only) Select the outgoing Interface for packets to use to go to the next hop.Use this for stricter control over which interface the managed firewall uses rather than the interface in the route table for the next hop in the route.Enter an Admin Distance for the route to override the default administrative distance set for static routes for the logical router.Range is 10 to 240; default is 10.Enter a Metric for the route.Range is 1 to 65,535; default is 10.(Optional) Select the BFD Profile so that the static route so that if the static route fails, the firewall removes the route from the RIB and FIB and uses an alternative route.Bidirectional Forwarding Detection (BFD) profiles allow you to apply BFD settings to a static route or routing protocol. Default is None (Disable BFD).(Optional) Enable Path Monitoring.- Select the Rule Type to specify whether Any or All of the monitored destinations for the static route must be unreachable by ICMP for the firewall to remove the static route from the RIB and FIB and add the static route that has the next lowest metric going to the same destination to the FIB.Select All to avoid the possibility of any single monitored signaling a route failure when the destination is simple offline for maintenance, for example.Specify the Preemptive Hold Time (min) to determine the number of minutes a downed path monitor must remain in Up state before the firewall reinstalls the static route into the RIB.The path monitor evaluates all of its monitored destinations for the static route and comes up based on the Any or All failure condition. If a link goes down or flaps during the hold time, when the link comes back up, the path monitor can come back up; the timer restarts when the path monitor returns to Up state.A Preemptive Hold Time of zero (0) causes the firewall to reinstall the route into the RIB immediately upon the path monitoring coming up. Range is 0 to 1440; default is 2.Add the static route.Update the logical router.Save the configuration changes to the logical router.Push Config to push your configuration changes.
