Static Route Removal Based on Path Monitoring

When you Configure Path Monitoring for a Static Route, the firewall uses path monitoring to detect when the path to one or more monitored destination has gone down. The firewall can then reroute traffic using alternative routes. The firewall uses path monitoring for static routes much like path monitoring for HA or policy-based forwarding (PBF), as follows:
  • The firewall sends ICMP ping messages (heartbeat messages) to one or more monitored destinations that you determine are robust and reflect the availability of the static route.
  • If pings to any or all of the monitored destinations fail, the firewall considers the static route down too and removes it from the Routing Information Base (RIB) and Forwarding Information Base (FIB). The RIB is the table of static routes the firewall is configured with and dynamic routes it has learned from routing protocols. The FIB is the forwarding table of routes the firewall uses for forwarding packets. The firewall selects an alternative static route to the same destination (based on the route with the lowest metric) from the RIB and places it in the FIB.
  • The firewall continues to monitor the failed route. When the route comes back up, and (based on the Any or All failure condition) the path monitor returns to Up state, the preemptive hold timer begins. The path monitor must remain up for the duration of the hold timer; then the firewall considers the static route stable and reinstates it into the RIB. The firewall then compares metrics of routes to the same destination to decide which route goes in the FIB.
Path monitoring is a desirable mechanism to avoid blackholing traffic for:
  • A static or default route.
  • A static or default route redistributed into a routing protocol.
  • A static or default route when one peer does not support BFD. (The best practice is not to enable both BFD and path monitoring on a single interface.)
  • A static or default route instead of using PBF path monitoring, which doesn’t remove a failed static route from the RIB, FIB, or redistribution policy.
    Path monitoring doesn’t apply to static routes configured between virtual routers.
In the following figure, the firewall is connected to two ISPs for route redundancy to the internet. The primary default route (metric 10) uses Next Hop; the secondary default route (metric 50) uses Next Hop The customer premises equipment (CPE) for ISP A keeps the primary physical link active, even after internet connectivity goes down. With the link artificially active, the firewall can’t detect that the link is down and that it should replace the failed route with the secondary route in its RIB.
To avoid blackholing traffic to a failed link, configure path monitoring of,, and and if all (or any) of the paths to these destinations fail, the firewall presumes the path to Next Hop is also down, removes the static route (that uses Next Hop from its RIB, and replaces it with the secondary route to the same destination (that uses Next Hop, which also accesses the internet.
When you Configure a Static Route, one of the required fields is the Next Hop toward that destination. The type of next hop you configure determines the action the firewall takes during path monitoring, as follows:
If Next Hop Type in Static Route is:
Firewall Action for ICMP Ping
IP Address
The firewall uses the source IP address and egress interface of the static route as the source address and egress interface in the ICMP ping. It uses the configured Destination IP address of the monitored destination as the ping’s destination address. It uses the static route’s next hop address as the ping’s next hop address.
Next VR
The firewall uses the source IP address of the static route as the source address in the ICMP ping. The egress interface is based on the lookup result from the next hop’s virtual router. The configured Destination IP address of the monitored destination is the ping’s destination address.
The firewall uses the destination IP address of the path monitor as the next hop and sends the ICMP ping to the interface specified in the static route.
When path monitoring for a static or default route fails, the firewall logs a critical event (path-monitor-failure). When the static or default route recovers, the firewall logs another critical event (path-monitor-recovery).
Firewalls synchronize path monitoring configurations for an active/passive HA deployment, but the firewall blocks egress ICMP ping packets on a passive HA peer because it is not actively processing traffic. The firewall doesn’t synchronize path monitoring configurations for active/active HA deployments.

Related Documentation