topic Re: Interface Monitoring in Next-Generation Firewall Discussions

Interface Monitoring

Sujanya — Mon, 08 May 2023 12:00:19 GMT

We have total 3 Interface , two ISP interface ( In router we have made them to act as Primary and Secondary) and one trust interface , now the confusion is I am trying to make if both ISP interface goes down , I need to make my trust interface also to goes down automatically by some monitoring feature. Is it possible to do that in Palo-Alto

Re: Interface Monitoring

BPry — Tue, 09 May 2023 15:17:36 GMT

@Sujanya,

Do you use a routing protocol like BGP or OSPF? If you use a standard Layer3/Layer2 interface and need to actually bring the interface down I think you'd have to script this check instead of being able to have the firewall do this itself.

Re: Interface Monitoring

Sujanya — Tue, 09 May 2023 16:33:26 GMT

@BPry ,

Thanks for the response. No we are using static routes only. and we are using layer3 as interface. Don't we have interface monitoring functionality in Palo-Alto.

Re: Interface Monitoring

BPry — Thu, 11 May 2023 19:35:33 GMT

@Sujanya,

You certainly have link and path monitoring functionality, but that's more of a failover consideration. The firewall isn't going to shutdown an interface due to link monitoring or path monitoring on the route itself. It would either trigger a HA failover or remove the route, not shutdown the interface.

Re: Interface Monitoring

Sujanya — Tue, 16 May 2023 05:15:36 GMT

@BPry ,

Thank you so much. I got it.