topic Re: Route check on PA firewall - Longest match not there?? in General Topics

Route check on PA firewall - Longest match not there??

ghostrider — Tue, 01 Nov 2016 20:11:20 GMT

Hello Experts

I want to check which route is matching for some host IP like 10.155.7.33, so I can check the outgoing interface and destination zone for policy lookup. When I run the command “show routing route destination 10.155.7.33/32”, it is showing nothing. Although I have matching route 10.115.7.0/24 in the routing table.

Kindly help !

Re: Route check on PA firewall - Longest match not there??

TranceforLife — Tue, 01 Nov 2016 22:08:58 GMT

Use traceroute command

Re: Route check on PA firewall - Longest match not there??

ghostrider — Wed, 02 Nov 2016 06:48:38 GMT

Thanks. Unfortunately traceroute is not allowed on firewall. For outgoing self traffic of firewall, like ping/traceroute, should I need intra-zone policy to allow source address: self ip of firewall, destination: any ?

But surprisingly, show routing route command does not show matching route. Strange ! or I am missing something

Appreciated your reply

Re: Route check on PA firewall - Longest match not there??

TranceforLife — Wed, 02 Nov 2016 09:14:59 GMT

Hi,

intra-zone traffic is permitted by default on FW. Self-traffic is not scanned by security policies, so if it is destined to the FW or initiated by FW.

Cheers

Re: Route check on PA firewall - Longest match not there??

ghostrider — Wed, 02 Nov 2016 11:16:08 GMT

Hello

In our fw, intra-zone policies are blocked so In this case I need to create explicit rules for traffic destined to the FW or initiated by FW?

Appreciated your reply

Re: Route check on PA firewall - Longest match not there??

Anon1 — Tue, 08 Nov 2016 22:00:24 GMT

The "show" command would only find something if you had a route exactly for 10.155.7.33/32.

However, what you want to use is the "test" command:

test routing fib-lookup virtual-router default ip <destination-ip>

Output will show which route matches this destination IP address.