topic Is there a similar service like IP SLA so the firewall can change default routes as a result of a certain condition in General Topics

Is there a similar service like IP SLA so the firewall can change default routes as a result of a certain condition

blaketraister — Tue, 04 Nov 2014 20:21:30 GMT

I was just curious...if I have 2 internet feeds but am not peering - I use ip/SLA to guanratee service. If a ping to 4.2.2.2 fails, it drops the current default route and the other default route with the higher AD is the active default route.

Is there something similar to this in PAN-OS?

Re: Is there a similar service like IP SLA so the firewall can change default routes as a result of a certain condition

bat — Tue, 04 Nov 2014 20:23:05 GMT

blaketraister

You are looking for PBF with monitoring.

Go through the following documents:

How to Configure ISP Redundancy and Load Balancing

Hope it helps!

Re: Is there a similar service like IP SLA so the firewall can change default routes as a result of a certain condition

HULK — Tue, 04 Nov 2014 20:27:48 GMT

Thanks

Re: Is there a similar service like IP SLA so the firewall can change default routes as a result of a certain condition

sbabu — Tue, 04 Nov 2014 23:53:03 GMT

Hi,

In PaloAlto there is no tracking protocol like IPSLA. However, you can configure default route for redundancy link with higher metric. If nexthop is not reachable or interface is down. The secondary route will take effect. Please find the below doc for the same.

Using Next Hop Versus Exit Interface for Default Route

If you network setup has redundant links to reach the next-hop, the best practice is to mention the next-hop along with the exit interface for the floating static routes to work efficiently.