Next-Generation Firewall
Configure a Static Route
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
- PAN-OS 9.1
-
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
-
-
-
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1
Configure a Static Route
Configure a static route to route Layer 3 traffic.
Contact your account team to enable Cloud Management for NGFWs using
Strata Cloud Manager.
Where Can I Use
This? | What Do I Need? |
---|---|
|
|
Configure a static route for your logical router to configure Layer
3 traffic to take a certain route without participating in IP routing protocols. A
default route is a specific static route. If you don’t use dynamic routing to obtain
a default route for your logical router, you must configure a static default route.
When the logical router has an incoming packet and finds no match for the packet
destination in its route table, the logical router sends the packet to the default
route. The default IPv4 route is 0.0.0.0/0; only a IPv4 default route is
supported.
By default,
static routes have an administrative distance of 10. When the firewall
has two or more routes to the same destination, it uses the route
with the lowest administrative distance. By increasing the administrative
distance of a static route to a value higher than a dynamic route,
you can use the static route as a backup route if the dynamic route
is unavailable.
While you’re configuring a static route, you can specify whether the firewall installs an IPv4
static route in the unicast or multicast route table (RIB), or both tables, or
doesn’t install the route at all. For example, you could install an IPv4 static
route in the multicast route table only, because you want only multicast traffic to
use that route. This option gives you more control over which route the traffic
takes.
- Log in toStrata Cloud Manager.
- Selectand select the Configuration Scope where you want to create the static route.ManageConfigurationNGFW and Prisma AccessDevice SettingsRoutingLogical RoutersYou can select a folder or firewall from yourFoldersor selectSnippetsto configure the static route in a snippet.
- Add Router.
- Enter a descriptiveName.A maximum of 63 characters are supported. The name must start with an alphanumeric character and can contain a combination of alphanumeric characters, underscore (_), hyphen (-), dot (.), and space.
- (Optional)AddanInterfaceto specify the outgoing interface for packets to use to go to the next hop.Use this for stricter control of which interface the firewall uses rather than the interface in the route table for the next hop of this route.
- Editthe Static IPv4 Static Routes.
- Add Static Routeto specify the next hop.
- Configure the static route.
- Enter aNamefor the static route.
- For theDestination, enter the IP address for the route destination.
- For theNext Hop, select one of the following.
- Discard(default)—Select to drop packets that are addressed to the destination.
- IP Address—Enter the IP address when you want to route to a specific next hop.
- (IP Address Next Hop only) Configure the next hopIP Address.
- (IP Address Next Hop only) Select the outgoingInterfacefor packets to use to go to the next hop.Use this for stricter control over which interface the managed firewall uses rather than the interface in the route table for the next hop in the route.
- Enter anAdmin Distancefor the route to override the default administrative distance set for static routes for the logical router.Range is10to240; default is10.
- Enter aMetricfor the route.Range is1to65,535; default is10.
- (Optional) Select theBFD Profileso that the static route so that if the static route fails, the firewall removes the route from the RIB and FIB and uses an alternative route.Bidirectional Forwarding Detection (BFD) profiles allow you to apply BFD settings to a static route or routing protocol. Default isNone (Disable BFD).
- (Optional)Enable Path Monitoring.
- Select theRule Typeto specify whetherAnyorAllof the monitored destinations for the static route must be unreachable by ICMP for the firewall to remove the static route from the RIB and FIB and add the static route that has the next lowest metric going to the same destination to the FIB.SelectAllto avoid the possibility of any single monitored signaling a route failure when the destination is simple offline for maintenance, for example.
- Specify thePreemptive Hold Time (min)to determine the number of minutes a downed path monitor must remain inUpstate before the firewall reinstalls the static route into the RIB.The path monitor evaluates all of its monitored destinations for the static route and comes up based on theAnyorAllfailure condition. If a link goes down or flaps during the hold time, when the link comes back up, the path monitor can come back up; the timer restarts when the path monitor returns toUpstate.APreemptive Hold Timeof zero (0) causes the firewall to reinstall the route into the RIB immediately upon the path monitoring coming up. Range is0to1440; default is2.
- Addthe static route.
- Updatethe logical router.
- Savethe configuration changes to the logical router.
- Push Configto push your configuration changes.