https://live.paloaltonetworks.com/t5/general-topics/how-the-interface-may-answer-ping-in-this-situation/m-p/63326#M38117 <P>You should configure multiple virtual routers. Each Virtual router should have it's own default route to the internet.</P><P>That should take care of routing for traffic which is terminating at PA device (ping, ike,...)</P><P>&nbsp;</P><P><A href="https://live.paloaltonetworks.com/t5/Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774" target="_blank">https://live.paloaltonetworks.com/t5/Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774</A></P> Wed, 19 Aug 2015 05:38:46 GMT mvidic 2015-08-19T05:38:46Z https://live.paloaltonetworks.com/t5/general-topics/how-the-interface-may-answer-ping-in-this-situation/m-p/63321#M38112 Hello for all. I had a problem that I resolved. But, I am posting because I could have solved of the best form. I have three links of internet. I have the firewall PA-200. These links are connected on three interfaces and the fourth interface is connected on my corporate network. The schema of links of internet is simple. This is controlled by PBFs: All traffic that try access the internet, this traffic goes out on link 1. The PBF rule monitor link state. If link is down, the link 2 will be used. Same think with link 2 to link 3. In my Virtual Router doesn't have default route. This system works but it have a little problem: When I want to create services (VPN IKE, Global Protect, etc) or I want to ping the IP of my interfaces (except the interface of corporate network), these connections doesn't work, forcing me to put a default route on my Virtual Router. This solution resolves my problem but this leaves the route totally asymmetrical. For example: If I put the default route on the link 1, if the connection arrives on link 2 or link 3, the reply uses a link 1. How I resolve this problem without putting a default route on my Virtual Router? Wed, 19 Aug 2015 01:36:54 GMT https://live.paloaltonetworks.com/t5/general-topics/how-the-interface-may-answer-ping-in-this-situation/m-p/63321#M38112 Bruce2 2015-08-19T01:36:54Z https://live.paloaltonetworks.com/t5/general-topics/how-the-interface-may-answer-ping-in-this-situation/m-p/63326#M38117 <P>You should configure multiple virtual routers. Each Virtual router should have it's own default route to the internet.</P><P>That should take care of routing for traffic which is terminating at PA device (ping, ike,...)</P><P>&nbsp;</P><P><A href="https://live.paloaltonetworks.com/t5/Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774" target="_blank">https://live.paloaltonetworks.com/t5/Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774</A></P> Wed, 19 Aug 2015 05:38:46 GMT https://live.paloaltonetworks.com/t5/general-topics/how-the-interface-may-answer-ping-in-this-situation/m-p/63326#M38117 mvidic 2015-08-19T05:38:46Z https://live.paloaltonetworks.com/t5/general-topics/how-the-interface-may-answer-ping-in-this-situation/m-p/69552#M40333 <P>Hi!</P> <P>&nbsp;</P> <P>It worked!</P> <P>&nbsp;</P> <P>Regards,</P> <P>&nbsp;</P> <P>Bruce Campos</P> Wed, 16 Dec 2015 18:28:48 GMT https://live.paloaltonetworks.com/t5/general-topics/how-the-interface-may-answer-ping-in-this-situation/m-p/69552#M40333 Bruce2 2015-12-16T18:28:48Z