Issue with Path Monitoring on Secondary ISP in Palo Alto Setup with Three ISPs

Jagdeep1 — Thu, 15 May 2025 16:55:19 GMT

We’re using three ISPs (Primary, Secondary, and Tertiary) in our Palo Alto firewall setup:

Primary: Ethernet 1/1 – Metric 10 (Path monitoring enabled with conditions set)
Secondary: Ethernet 1/2 – Metric 20 (Path monitoring enabled with conditions set)
Tertiary: Ethernet 1/3 – Metric 50

However, the path monitoring on the secondary interface is down. We've double-checked all settings multiple times but haven't been able to resolve the issue. Every time a failover occurs, the traffic switches to the tertiary interface, and the recovery always reverts to the primary, as the secondary interface's path monitoring remains down.

We’re wondering if we might be overlooking something in the configuration when setting up three ISPs in Palo Alto (since configuring two ISPs is usually more straightforward).

Has anyone faced a similar issue or have any suggestions on how to resolve this? or if the three ISPs redundancy supported this way in palo alto.

Any help would be greatly appreciated!

Re: Issue with Path Monitoring on Secondary ISP in Palo Alto Setup with Three ISPs

SutareMayur — Tue, 03 Jun 2025 14:16:52 GMT

Hi @Jagdeep1 If you are seeing path monitoring for ISP2 is down, did you try to check ping responses manually from desired source IP to configured destination IP to see if you are getting response. You can try this from cli using command ping source x.x.x.x host x.x.x.x . Until there is no response, path monitoring will be DOWN.

topic Issue with Path Monitoring on Secondary ISP in Palo Alto Setup with Three ISPs in Next-Generation Firewall Discussions

Issue with Path Monitoring on Secondary ISP in Palo Alto Setup with Three ISPs

Re: Issue with Path Monitoring on Secondary ISP in Palo Alto Setup with Three ISPs