1. Home
    2. PAN-OS
    3. PAN-OS® Networking Administrator’s Guide
    4. Static Routes
    5. Configure Path Monitoring for a Static Route

    Configure Path Monitoring for a Static Route

    Use the following procedure to configure Static Route Removal Based on Path Monitoring.
    1. Enable path monitoring for a static route.
      1. Select
        Network
        Virtual Routers
         and select a virtual router.
      2. Select
        Static Routes
        , select
        IPv4
         or
        IPv6
        , and select the static route you want to monitor. You can monitor up to 128 static routes.
      3. Select
        Path Monitoring
         to enable path monitoring for the route.
    2. Configure the monitored destination(s) for the static route.
      1. Add
         a monitored destination by
        Name
        . You can add up to eight monitored destinations per static route.
      2. Select
        Enable
         to monitor the destination.
      3. For
        Source IP
        , select the IP address that the firewall uses in the ICMP ping to the monitored destination:
        • If the interface has multiple IP addresses, select one.
        • If you select an interface, the firewall uses the first IP address assigned to the interface by default.
        • If you select
          DHCP (Use DHCP Client address)
          , the firewall uses the address that DHCP assigned to the interface. To see the DHCP address, select
          Network
          Interfaces
          Ethernet
           and in the row for the Ethernet interface, click on
          Dynamic DHCP Client
          . The IP Address displays in the Dynamic IP Interface Status window.
      4. For
        Destination IP
        , enter an IP address or address object to which the firewall will monitor the path. The monitored destination and static route destination must use the same address family (IPv4 or IPv6).
        The destination IP address should belong to a reliable endpoint; you wouldn’t want to base path monitoring on a device that itself is unstable or unreliable.
      5. (
        Optional
        ) Specify the ICMP
        Ping Interval (sec)
         in seconds to determine how frequently the firewall monitors the path (range is 1-60; default is 3).
      6. (
        Optional
        ) Specify the ICMP
        Ping Count
         of packets that don’t return from the destination before the firewall considers the static route down and removes it from the RIB and FIB (range is 3-10; default is 5).
      7. Click
        OK
        .
    3. Determine whether path monitoring for the static route is based on one or all monitored destinations, and set the preemptive hold time.
      1. Select a
        Failure Condition
        , whether
        Any
         or
        All
         of the monitored destinations for the static route must be unreachable by ICMP for the firewall to remove the static route from the RIB and FIB and add the static route that has the next lowest metric going to the same destination to the FIB.
        Select
        All
         to avoid the possibility of any single monitored destination signaling a route failure when the destination is simply offline for maintenance, for example.
      2. (
        Optional
        ) Specify the
        Preemptive Hold Time (min)
        , which is the number of minutes a downed path monitor must remain in Up state before the firewall reinstalls the static route into the RIB. The path monitor evaluates all of its monitored destinations for the static route and comes up based on the
        Any
         or
        All
         failure condition. If a link goes down or flaps during the hold time, when the link comes back up, the path monitor can come back up; the timer restarts when the path monitor returns to Up state.
        A
        Preemptive Hold Time
         of zero causes the firewall to reinstall the route into the RIB immediately upon the path monitor coming up. Range is 0-1,440; default is 2.
      3. Click
        OK
        .
    4. Commit.
      Click
      Commit
      .
    5. Verify path monitoring on static routes.
      1. Select
        Network
        Virtual Routers
         and in the row of the virtual router you are interested in, select
        More Runtime Stats
        .
      2. From the
        Routing
         tab, select
        Static Route Monitoring
        .
      3. For a static route (Destination), view whether Path Monitoring is Enabled or Disabled. The Status column indicates whether the route is Up, Down, or Disabled. Flags for the static route are: A—active, S—static, E—ECMP.
      4. Select
        Refresh
         periodically to see the latest state of the path monitoring (health check).
      5. Hover over the Status of a route to view the monitored IP addresses and results of the pings sent to the monitored destinations for that route. For example, 3/5 means that a ping interval of 3 seconds and a ping count of 5 consecutive missed pings (the firewall receives no ping in the last 15 seconds) indicates path monitoring detects a link failure. Based on the
        Any
         or
        All
         failure condition, if path monitoring is in failed state and the firewall receives a ping after 15 seconds, the path can be deemed up and the
        Preemptive Hold Time
         starts.
        The State indicates the last monitored ping results: success or failed. Failed indicates that the series of ping packets (ping interval multiplied by ping count) was not successful. A single ping packet failure does not reflect a failed ping state.
    6. View the RIB and FIB to verify that the static route is removed.
      1. Select
        Network
        Virtual Routers
         and in the row of the virtual router you are interested in, select
        More Runtime Stats
        .
      2. From the
        Routing
         tab, select
        Route Table
         (RIB) and then the
        Forwarding Table
         (FIB) to view each, respectively.
      3. Select
        Unicast
         or
        Multicast
         to view the appropriate route table.
      4. For
        Display Address Family
        , select
        IPv4 and IPv6
        ,
        IPv4 Only
        , or
        IPv6 Only
        .
      5. (
        Optional
        ) In the filter field, enter the route you are searching for and select the arrow, or use the scroll bar to move through pages of routes.
      6. See if the route is removed or present.
      7. Select
        Refresh
         periodically to see the latest state of the path monitoring (health check).
        To view the events logged for path monitoring, select
        Monitor
        Logs
        System
        . View the entry for
        path-monitor-failure
        , which indicates path monitoring for a static route destination failed, so the route was removed. View the entry for
        path-monitor-recovery
        , which indicates path monitoring for the static route destination recovered, so the route was restored.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2023 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo