topic Re: Static route path monitoring doesn't recover in General Topics

Static route path monitoring doesn't recover

Dennis-Wu — Fri, 24 May 2019 01:32:03 GMT

Configured the path monitor on my primary ISP route per this guide,

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/static-routes/static-route-removal-based-on-path-monitoring.html#

It worked great when I unplug the cable from the primary ISP CPE. The default route went to the back up ISP. Problem is the primary default route doesn't recover when I put the cable back. I waited till the monitor claim the status is up. But the primary default route is shown inactive (missing A flag).

BTW: the backup ISP is DHCP with automatically add default route enabled.

Re: Static route path monitoring doesn't recover

kiwi — Fri, 24 May 2019 07:22:58 GMT

Hi @Dennis-Wu ,

Did you enable preemtion ?

By default, preemption is disabled on the firewalls and must be enabled on both firewalls. When enabled, the preemptive behavior allows the firewall with the higher priority to resume as active or active-primary after it recovers from a failure.

device-priority-and-preemption

Cheers !

-Kiwi.

Re: Static route path monitoring doesn't recover

BPry — Fri, 24 May 2019 13:12:01 GMT

@Dennis-Wu,

When the monitor claims the status is up is when the preemptive hold timer actually starts counting down to verify the path is stable. By default, this is set to 2 minutes. Did you allow enough time for the preemptive hold timer to pass so the link should have actually become active?

Also important, did you weight the route metrics?

Re: Static route path monitoring doesn't recover

Dennis-Wu — Fri, 24 May 2019 16:00:37 GMT

@BPry appreciate your hint. I did wait till the preemptive time finished. And the metric is correct as in the begining before I unplug the primary ISP cable the default route was pointing to the primary ISP correctly.

Update: Found it actually interference with the DHCP type of ISP. I have to disable the "automaticlly create default route" on the interface and use a static route with next hop to the ISP GW. It is not a 100% solution as the ISP GW could change. But I can live with it for now

Re: Static route path monitoring doesn't recover

AlexandroDelAngel — Thu, 28 Oct 2021 14:08:03 GMT

Hi @BPry ,

Do you know by any chance if there´s a way to monitor via CLI the count down of the preemptive hold timer? I just started supporting a deployment where the prior integrator configured 60 minutes of preemption, so at least I would like to know if the timer is actually counting down or not.

Thanks in advance!

Re: Static route path monitoring doesn't recover

OtakarKlier — Thu, 28 Oct 2021 20:54:28 GMT

Hello,

For this scenario, I usually utilize Policy Based Forwarding. Pretty much the same thing, however PBF happens before the virtual routers data so its always first.

Just a thought.

Re: Static route path monitoring doesn't recover

acastillo890 — Wed, 01 Feb 2023 18:25:33 GMT

I am having the same issue. Even when I attempt to perform the same ping ingress and egress from both firewalls the pings are successful. Both sides are Palo Alto's in my case.