topic Routing issue in General Topics

Routing issue

Es_tecsupportsecurity — Fri, 24 Feb 2017 12:15:40 GMT

Hi,

We are expecting a routing problem. Our Pa is learning router from eth1 from OSPF, so the VoIP traffic is going through this interface properly, on the another hand we have a VPN configured in another ISP just in case OSPF goes down. the problem is that OSPF is working fine and suddenly some connections (same source/destination) are going through VPN.

10.0.0.0/8 10.3.200.14 220 A S tunnel.4 (VPN BACKUP TUNEL)

10.0.24.0/22 10.3.0.1 10 A O2 19554 ethernet1/1 (MPLS) (MAIN)

OSPF learn routes have more preference than static rotue to the tunnel.

PA version is 7.1.4-h2

Why PA is routing some connections to the tunnel??????

Re: Routing issue

BPry — Fri, 24 Feb 2017 12:59:45 GMT

@Es_tecsupportsecurity the below article might help you a little bit.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Influence-Routes-in-OSPF-to-Take-Precedence-Over-Static/ta-p/62590

Re: Routing issue

Es_tecsupportsecurity — Fri, 24 Feb 2017 13:02:14 GMT

I checked this document. Static route has 220 of Administrative distance, so its higher than OSPF.

Re: Routing issue

OtakarKlier — Fri, 24 Feb 2017 14:42:40 GMT

Hello,

If the route is more specific, it doesnt matter what the admin distance is, it will be preferred. I have setup connections similar to the one you have many times and use Policy Based Routing rules with a monitor to force traffic over the 'better' link and fail over automatically.

This is an older doc but still holds true.

https://live.paloaltonetworks.com/t5/Configuration-Articles/Dual-ISP-Branch-Office-Configuration/ta-p/59346

This one is a bit newer but the config does not require multiple VR's

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-Palo-Alto-Networks-Firewall-with-Dual-ISPs/ta-p/59774

Hope that helps.

Re: Routing issue

Es_tecsupportsecurity — Mon, 27 Feb 2017 08:43:39 GMT

Yes i know, route more specifi is over MPLS so this is OK. The behaviour is expected but suddenly traffic is going trough VPN with no reason.