topic static routes for 2 wan links with DHCP dynamic IPs in General Topics

static routes for 2 wan links with DHCP dynamic IPs

nevolex — Fri, 03 Nov 2023 21:08:43 GMT

Hi everyone,

I would like to ask for some assistance in my configuration, the palo alto firewall has been so far a pretty frustrating experience, I guess due to my lack of knowledge of Pas

i have 2 wan dhcp dynamic ips links

I would like to implement some redundancy

if 1 link goes down - the second link activates and when the primary goes back, it failovers back

very simple setting

I hav dhcp enabled on both interfaces and I have disabled "automatically install the default route from the isp"

I went to logical routes and created:

a static route 1 with metric 10 : 0.0.0.0/0 --> next hope "none" and interface being the wan 1 (I have a dynamic next hop, so i cannot point to the temp gateway)

a static route 2 with metric 200 : 0.0.0.0/0 --> next hope "none" and interface being the wan 2 I have a dynamic next hop, so i cannot point to the temp gateway)

enabled route monitoring and after installing I get

Path monitoring failed for static route destination 0.0.0.0/0 with next hop ethernet1/2. Route removed.
11/04 06:04:28
Path monitoring failed for static route destination 0.0.0.0/0 with next hop ethernet1/1. Route removed.

so obviously after that internet is not working

can you please advise what do i do wrong, why the PA cannot identity the next hop dinamically via the interface it was told to use??

thank you

Re: static routes for 2 wan links with DHCP dynamic IPs

Raido_Rattameister — Sat, 04 Nov 2023 01:41:32 GMT

Static route you try to configure will be removed from virtual router only if interface physically goes down.

If you would have static IPs from ISP you could set up path monitoring inside the static route.

What you are trying to accomplish is as good as leaving "automatically install the default route from the isp" in place and setting route metric on one DHCP interface to 10 and 200 on other.

You can't configure path monitoring if your interface don't have IP.

Theoretically you could wait for DHCP to pick up gateway IP and then set up PBF with next hop to that gateway IP.

And then second PBF under first one towards secondary ISP.

If your ISP don't change subnet then gateway should be more or less the same all the time.

As PBF is processed before virtual router if there is matching PBF then virtual router is bypassed.

Re: static routes for 2 wan links with DHCP dynamic IPs

nevolex — Sat, 04 Nov 2023 07:33:19 GMT

Thank you for your reply Raido_Rattameister

I will use your suggestion, would you know how in this case configure the static router for sdwan? Thank you