>
    Strata Copilot
    Configure Virtual Routers
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Configure Virtual Routers
    Download PDF
    Next-Generation Firewall

    Configure Virtual Routers

    Table of Contents

    Configure Virtual Routers

    On a firewall that uses the legacy routing engine, configure a virtual router to participate in Layer 3 routing.
    Where Can I Use This?What Do I Need?
    • NGFW
    One of these licenses for Strata Cloud Manager managed NGFWs:
    • Strata Cloud Manager Essentials
    • Strata Cloud Manager Pro
    The firewall uses virtual routers to obtain Layer 3 routes to other subnets. The firewall obtains routes when you manually define static routes or when the firewall participates in one or more Layer 3 routing protocols (dynamic routes).
    The routes that the firewall obtains through these methods populate the IP routing information base (RIB) on the firewall. When a packet is destined for a different subnet than the one it arrived on, the virtual router obtains the best route from the RIB, places it in the forwarding information base (FIB), and forwards the packet to the next hop router defined in the FIB. The firewall uses Ethernet switching to reach other devices on the same IP subnet.
    The Ethernet, VLAN, and tunnel interfaces defined on the firewall receive and forward Layer 3 packets. The destination zone is derived from the outgoing interface based on the forwarding criteria, and the firewall consults policy rules to identify the security policies that it applies to each packet. In addition to routing to other network devices, virtual routers can route to other virtual routers within the same firewall if a next hop is specified to point to another virtual router.
    You can configure interfaces on a virtual router to participate with dynamic routing protocols (BGP, OSPF, OSPFv3, or RIP) as well as add static routes. You can also create multiple virtual routers, each maintaining a separate set of routes that aren't shared between virtual routers, enabling you to configure different routing behaviors for different interfaces.
    For example, if you need to configure multiple BGP AS numbers, you must create separate virtual routers because each virtual router supports only one BGP Local AS.
    You can configure dynamic routing from one virtual router to another by configuring a loopback interface in each virtual router, creating a static route between the two loopback interfaces, and then configuring a dynamic routing protocol to peer between these two interfaces. The firewall supports only one hop between virtual routers. For example, with virtual routers A, B, and C, a route cannot go from A to B to C; it would have to go from A to C. This inter-VR routing capability is useful when you need multiple BGP AS numbers; you can create a virtual router for each AS and use static routes with the next hop set to another virtual router to enable communication between them.
    Each Layer 3 Ethernet, loopback, VLAN, and tunnel interface defined on the firewall must be associated with a virtual router. While each interface can belong to only one virtual router, you can configure multiple routing protocols and static routes for a virtual router.
    You can migrate your existing NGFW configurations from Panorama to Strata Cloud Manager using the Migrate NGFW Configuration from Panorama workflow, available at ConfigurationOnboardingNGFW PanoramaConfigure Migration.

    Configure Virtual Routers (Strata Cloud Manager)

    Configure a virtual router in Strata Cloud Manager for firewalls using the legacy routing engine.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationNGFW and Prisma Access and select the Configuration Scope where you want to create the virtual router.
    3. Select Network & DeviceRoutingVirtual Routers tab.
      On new Strata™ Cloud Manager tenants, the Routing page displays both Logical Routers and Virtual Routers tabs; existing Strata™ Cloud Manager tenants see only the Virtual Routers tab.
      You can select a folder or firewall from your Folders, or select Snippets to configure the virtual router in a snippet.
      Virtual router configurations apply only to firewalls configured to use the legacy routing engine. You set the routing mode at the device level. Firewalls using the Advanced Routing Engine use logical router configurations instead.
    4. Click Add Virtual Routers.
    5. Enter a descriptive Name.
    6. Enable Equal Cost Multiple Path (ECMP) for a virtual router.
      • Specify the maximum number of equal-cost paths (to a destination network) that can be copied from the Routing Information Base (RIB) to the Forwarding Information Base (FIB). For ECMP Max Path, enter 2, 3, or 4. Default is 2.
      • Enable symmetric return of packets from server to client. Select Symmetric Return to cause return packets to egress out the same interface on which the associated ingress packets arrived. That is, the firewall will use the ingress interface on which to send return packets, rather than use the ECMP interface. The Symmetric Return setting overrides load balancing. This behavior occurs only for traffic flows from the server to the client.
      • Enable Strict Source Path to ensure that IKE and IPSec traffic originating at the firewall egresses the physical interface to which the source IP address of the IPSec tunnel belongs.When you enable ECMP, IKE and IPSec traffic originating at the firewall by default egresses an interface that an ECMP load-balancing method determines. Alternatively, you can ensure that IKE and IPSec traffic originating at the firewall always egresses the physical interface to which the source IP address of the IPSec tunnel belongs, by enabling Strict Source Path. You would enable this function when the firewall has more than one ISP providing equal-cost paths to the same destination. ISPs typically perform a reverse Path Forwarding (RPF) check (or a different check to prevent IP address spoofing) to confirm that traffic is egressing the same interface on which it arrived. Because ECMP would choose an egress interface based on the configured ECMP method (instead of choosing the source interface as the egress interface), that wouldn’t be what the ISP expects and the ISP could block legitimate return traffic. In this case, enable Strict Source Path so that the firewall uses the egress interface that is the interface to which the source IP address of the IPSec tunnel belongs, the RPF check succeeds, and the ISP allows the return traffic.
      • Specify the load-balance Action for the virtual router.
        • Balanced Round Robin—Uses round-robin among the ECMP paths and rebalances paths when the number of paths changes.
        • IP Hash—Use a hash of the source and destination IP addresses to determine which ECMP route to use. If you select this option, can select to Use Source Address Only and Use Source/ Destination port for hash.
        • IP Modulo—Uses a hash of the source and destination IP addresses in the packet header to determine which ECMP route to use.
        • Weighted Round Robin—Uses round-robin and a relative weight to select from among ECMP paths.
    7. Add an Interface.
      Repeat this step to add as many Layer 3, loopback, and tunnel interfaces as needed.
    8. Add an Interface.
      Repeat this step to add as many Layer 3, loopback, VLAN, and tunnel interfaces as needed. Each interface can belong to only one virtual router.
    9. (Optional) Set Administrative Distances for static and dynamic routing.
      When the virtual router has two or more different routes to the same destination, it uses administrative distance to choose the best path, preferring a lower distance.
      1. Select Advanced SettingsAdministrative Distances.
      2. Set the administrative distances as required for your network.
        • Static—Range is 10 to 240; default is 10.
        • OSPF Internal—Range is 10 to 240; default is 30.
        • OSPF External—Range is 10 to 240; default is 110.
        • IBGP—Range is 10 to 240; default is 200.
        • EBGP—Range is 10 to 240; default is 20.
        • RIP—Range is 10 to 240; default is 120.
    10. Configure the following settings:
      • Static Route
      • BGP
      • Multicast
      • OSPF
      • OSPFv3
    11. Save.
    12. Push Config to push your configuration changes.

    Clone a Virtual Router

    You can clone an existing Logical Router into a folder or snippet to use as a starting point for a new configuration, avoiding the need to build it from scratch.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationNGFW and Prisma Access and from the Configuration Scope, select the device.
    3. Select Network & DeviceRoutingVirtual Routers tab.
    4. Select the router you want to Clone.
    5. For Destination Rule Type, choose Folders or Snippets.
    6. From Destination, choose the target folder or snippet.
    7. Enable Error out on first detected error in validation to stop the clone if validation fails.
    8. Clone the router.

    Troubleshoot a Virtual Router

    You can view or search the routing table on a device directly from the Strata Cloud Manager.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationNGFW and Prisma Access and from the Configuration Scope, select the device.
    3. Select Network & DeviceRoutingVirtual Routers tab.
    4. Select the router you want to Troubleshoot.
    5. Select the Troubleshooting Type: Routing.
    6. For Target Devices, choose the device to run the troubleshooting action on.
    7. For Action, choose one of the following: Show Routing Table and Search the Routing Table
    8. Execute.

    Configure Virtual Routers (PAN-OS)

    Configure a virtual router in PAN-OS to enable Layer 3 routing on the legacy routing engine.
    1. Gather the required information from your network administrator.
      • Interfaces on the firewall that you want to perform routing.
      • Administrative distances for static, OSPF internal, OSPF external, IBGP, EBGP, and RIP.
    2. Create a virtual router and apply interfaces to it.
      The firewall comes with a virtual router named default. You can edit the default virtual router or add a new virtual router.
      1. Select NetworkVirtual Routers.
      2. Select a virtual router (the one named default or a different virtual router) or Add the Name of a new virtual router.
      3. Select Router SettingsGeneral.
      4. Click Add in the Interfaces box and select an already defined interface.
        Repeat this step for all interfaces you want to add to the virtual router.
      5. Click OK.
    3. (Optional) Set administrative distances for static and dynamic routing.
      When the virtual router has two or more different routes to the same destination, it uses administrative distance to choose the best path from different routing protocols and static routes, preferring a lower distance.
      • Static—Range is 10 to 240; default is 10.
      • OSPF Internal—Range is 10 to 240; default is 30.
      • OSPF External—Range is 10 to 240; default is 110.
      • IBGP—Range is 10 to 240; default is 200.
      • EBGP—Range is 10 to 240; default is 20.
      • RIP—Range is 10 to 240; default is 120.
      See ECMP if you want to leverage having multiple equal-cost paths for forwarding.
    4. Click OK and Commit.
    5. Configure Ethernet, VLAN, loopback, and tunnel interfaces as needed.
      Configure Layer 3 Interfaces.

    © 2026 Palo Alto Networks, Inc. All rights reserved.