topic Re: Service route destination option in General Topics

Service route destination option

hrsingh — Fri, 24 Jun 2016 14:05:01 GMT

What is the purpose of adding destination in service route?

We have a default gateway in management interface config and we also have specific route in vr so why we need it?

Re: Service route destination option

Raido_Rattameister — Fri, 24 Jun 2016 14:21:21 GMT

All requests that go out from firewall (URL category check, DNS requests, content updates, Wildfire etc) go out from management interface by default.

In some environments management interface connects to management network that has no access to internet.

Route entries that are in virtual router do not apply to traffic that goes out from management interface.

Re: Service route destination option

TranceforLife — Fri, 24 Jun 2016 14:51:10 GMT

Hi,

There you go :

https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-a-Service-Route-for-Services-to-Use-a-Dataplane/ta-p/59433

So by default for all traffic that generated by the device itself, Palo will use mgmt interface and default gateway configured on the management interface settings. By default it will NOT use the default gateway configured on the VR or source IP configured on the interfaces. You need to specify this using "service route" settings.

Cheers

Re: Service route destination option

Roby_Sreejith — Fri, 24 Jun 2016 14:53:11 GMT

In simple words:

By default for the services defined under service route tab" management interface " is used.

You can chnage this for the defined services via service route tab

But there will be some other non defined services( i believe which might som other logs) , for those we need destination.

But some one needs to clarify this:

So if we define any destination address in service-route tab, how routing happen?

Is it something like: first it will make sure the traffic is orginated using the source interface we mention then routing table entries.

Please explain

Re: Service route destination option

hrsingh — Sat, 25 Jun 2016 15:35:51 GMT

Roby,

May be some services which are not show in the service we can have destination route for that service I guess.

Regards

HSingh

Re: Service route destination option

Roby_Sreejith — Mon, 27 Jun 2016 05:49:16 GMT

For that routing is fine right