Configure a Static Route
Focus
Focus
Next-Generation Firewall

Configure a Static Route

Table of Contents

Configure a Static Route

Configure a static route to route Layer 3 traffic.
Contact your account team to enable Cloud Management for NGFWs using Strata Cloud Manager.
Where Can I Use This?
What Do I Need?
  • NGFW (Managed by Strata Cloud Manager)
  • VM-Series, funded with Software NGFW Credits
  • AIOps for NGFW Premium license (use the Strata Cloud Manager app)
Configure a static route for your logical router to configure Layer 3 traffic to take a certain route without participating in IP routing protocols. A default route is a specific static route. If you don’t use dynamic routing to obtain a default route for your logical router, you must configure a static default route. When the logical router has an incoming packet and finds no match for the packet destination in its route table, the logical router sends the packet to the default route. The default IPv4 route is 0.0.0.0/0; only a IPv4 default route is supported.
By default, static routes have an administrative distance of 10. When the firewall has two or more routes to the same destination, it uses the route with the lowest administrative distance. By increasing the administrative distance of a static route to a value higher than a dynamic route, you can use the static route as a backup route if the dynamic route is unavailable.
While you’re configuring a static route, you can specify whether the firewall installs an IPv4 static route in the unicast or multicast route table (RIB), or both tables, or doesn’t install the route at all. For example, you could install an IPv4 static route in the multicast route table only, because you want only multicast traffic to use that route. This option gives you more control over which route the traffic takes.
  1. Log in to
    Strata Cloud Manager
    .
  2. Select
    Manage
    Configuration
    NGFW and Prisma Access
    Device Settings
    Routing
    Logical Routers
    and select the Configuration Scope where you want to create the static route.
    You can select a folder or firewall from your
    Folders
    or select
    Snippets
    to configure the static route in a snippet.
  3. Add Router
    .
  4. Enter a descriptive
    Name
    .
    A maximum of 63 characters are supported. The name must start with an alphanumeric character and can contain a combination of alphanumeric characters, underscore (
    _
    ), hyphen (
    -
    ), dot (
    .
    ), and space.
  5. (
    Optional
    )
    Add
    an
    Interface
    to specify the outgoing interface for packets to use to go to the next hop.
    Use this for stricter control of which interface the firewall uses rather than the interface in the route table for the next hop of this route.
  6. Edit
    the Static IPv4 Static Routes.
  7. Add Static Route
    to specify the next hop.
  8. Configure the static route.
    1. Enter a
      Name
      for the static route.
    2. For the
      Destination
      , enter the IP address for the route destination.
    3. For the
      Next Hop
      , select one of the following.
      • Discard
        (default)—Select to drop packets that are addressed to the destination.
      • IP Address
        —Enter the IP address when you want to route to a specific next hop.
    4. (
      IP Address Next Hop only
      ) Configure the next hop
      IP Address
      .
    5. (
      IP Address Next Hop only
      ) Select the outgoing
      Interface
      for packets to use to go to the next hop.
      Use this for stricter control over which interface the managed firewall uses rather than the interface in the route table for the next hop in the route.
    6. Enter an
      Admin Distance
      for the route to override the default administrative distance set for static routes for the logical router.
      Range is
      10
      to
      240
      ; default is
      10
      .
    7. Enter a
      Metric
      for the route.
      Range is
      1
      to
      65,535
      ; default is
      10
      .
    8. (
      Optional
      ) Select the
      BFD Profile
      so that the static route so that if the static route fails, the firewall removes the route from the RIB and FIB and uses an alternative route.
      Bidirectional Forwarding Detection (BFD) profiles allow you to apply BFD settings to a static route or routing protocol. Default is
      None (Disable BFD)
      .
  9. (
    Optional
    )
    Enable Path Monitoring
    .
    1. Select the
      Rule Type
      to specify whether
      Any
      or
      All
      of the monitored destinations for the static route must be unreachable by ICMP for the firewall to remove the static route from the RIB and FIB and add the static route that has the next lowest metric going to the same destination to the FIB.
      Select
      All
      to avoid the possibility of any single monitored signaling a route failure when the destination is simple offline for maintenance, for example.
    2. Specify the
      Preemptive Hold Time (min)
      to determine the number of minutes a downed path monitor must remain in
      Up
      state before the firewall reinstalls the static route into the RIB.
      The path monitor evaluates all of its monitored destinations for the static route and comes up based on the
      Any
      or
      All
      failure condition. If a link goes down or flaps during the hold time, when the link comes back up, the path monitor can come back up; the timer restarts when the path monitor returns to
      Up
      state.
      A
      Preemptive Hold Time
      of zero (
      0
      ) causes the firewall to reinstall the route into the RIB immediately upon the path monitoring coming up. Range is
      0
      to
      1440
      ; default is
      2
      .
  10. Add
    the static route.
  11. Update
    the logical router.
  12. Save
    the configuration changes to the logical router.
  13. Push Config
    to push your configuration changes.

Recommended For You