topic Re: Palo alto static routing issue in General Topics

Palo alto static routing issue

BigPalo — Fri, 16 Mar 2018 11:48:44 GMT

Hi,

We are configuring a new routing scenario but we are expecting problem taking the correct route.

This is our static route table:

destination interface gateway metric

10.50.1.0/24 eth1/1 10.50.250.1 1

10.50.2.0/24 eth1/1 10.50.250.1 1

10.0.0.0/8 eth1/5 10.50.50.4 10

If we run a "test routing fib.....", we can see all traffic going to 10.0.0.0/8 route. Although we have two /24 routes.

If we run a session to ip 10.50.2.10 (second route). The firewall is sending the traffic to gateway 10.50.50.4. Why???

We have two routes more restrictive and with more metric in order to take preference but its not working.

I undertand that the static routers election is:

1) Metric (less metric. more preference)

2) Restrictive route. Mask /8 is less preference than /24.

Why FW is taking the route /8??? We have had to create PBR in order to solve it.

Re: Palo alto static routing issue

Mick_Ball — Fri, 16 Mar 2018 12:19:13 GMT

I don't understand your setup

what is the ip interfaces of eth/1 and eth/5, including masks.

Re: Palo alto static routing issue

BigPalo — Fri, 16 Mar 2018 12:48:31 GMT

Its quite simple.

We have a 10.0.0.0/8 route going to eth5 interface. But we want that several /24 networks take another different interface.

To my undertand i thought that metric or restrictive route will take preference over /8 route.

Re: Palo alto static routing issue

Mick_Ball — Fri, 16 Mar 2018 12:51:03 GMT

yes it does. /24 beats /8, regardless of metric.

but only if the route is valid.

please post the ip interfaces of eth1/1 and eth1/5. this may show that your route is invalid,

Re: Palo alto static routing issue

BigPalo — Fri, 16 Mar 2018 13:07:14 GMT

Eth1/1 FW IP is 10.50.250.2

Eth1/5 FW IP is 10.50.50.5

I dont think this is related to IP interface.

Re: Palo alto static routing issue

reaper — Fri, 16 Mar 2018 13:24:33 GMT

This should work as expected, can you share the rest of your config (interface ip's and full routing table, possibly the output of show routing route etc) so we can have a better view of what could be going on?

your assumption is conrrect theat the smaller subnet should get preference over the supernet, but maybe we're missing something in the bigger picture

Re: Palo alto static routing issue

BigPalo — Fri, 16 Mar 2018 13:38:22 GMT

This is the scenario. We have the routes to avoid asymmetric routing.

Its weird that evrything is taking the /8 route.

Re: Palo alto static routing issue

Mick_Ball — Fri, 16 Mar 2018 13:47:35 GMT

what is the subnet mask of 10.50.50.5

Re: Palo alto static routing issue

BigPalo — Fri, 16 Mar 2018 13:53:47 GMT

/28. we have HSRP in 4500 device

Re: Palo alto static routing issue

Mick_Ball — Fri, 16 Mar 2018 14:02:31 GMT

Hmmm... weird..

just as a test... if you add the following static route..

destination interface gateway metric

172.21.50.0/24 eth1/1 10.50.250.1 1

and trace route to 172.21.50.1, where does that go... 250.1 or 50.4 ?

Re: Palo alto static routing issue

mlinsemier — Fri, 16 Mar 2018 15:53:43 GMT

What version of PAN-OS are you running? Did you verify that all of the routes are actually showing up in the fib on Palo Alto firewall (you may have to disable PBR to see this)? Is interface monitoring enabled?

- Matt

Re: Palo alto static routing issue

BigPalo — Mon, 19 Mar 2018 07:42:46 GMT

PanOS is: 6.1.14

This is the routing table.

FW is always taking the route 10.0.0.0./8, although we have several /24.....

Re: Palo alto static routing issue

Mick_Ball — Mon, 19 Mar 2018 09:25:55 GMT

are you sure 10.50.250.1 is a valid interface.

if not then your /24 routes will depreciate and /8 will be used.

Re: Palo alto static routing issue

BigPalo — Mon, 19 Mar 2018 09:35:29 GMT

Yes it is. The previous capture was done in "more runtime stats". So the route is being applied in current routing table.

Re: Palo alto static routing issue

reaper — Mon, 19 Mar 2018 09:40:30 GMT

can you double check if the 10.50.250.0 subnet shows up in the routing table as 'connected' (and a /32 as 'Host') , this is necessary for it to be useable as nexthop for other routes

reaper@myNGFW> show routing route 

flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, 
       Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast

  
VIRTUAL ROUTER: vr_internet (id 1)
  ==========
destination            nexthop            metric flags age   interface     next-AS    
0.0.0.0/0              198.51.100.1       10     A S         ethernet1/1                   
198.51.100.0/24        198.51.100.241     0      A C         ethernet1/1                   
198.51.100.241/32      0.0.0.0            0      A H

Re: Palo alto static routing issue

BigPalo — Tue, 20 Mar 2018 14:26:37 GMT

Hi,

This is routing table:

flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,
Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2

VIRTUAL ROUTER: Router Virtual (id 2)
==========
destination nexthop metric flags age interface next-
AS

10.0.0.0/8 10.50.50.4 10 A S ethernet1/5

10.47.1.0/29 10.50.250.1 1 A S ethernet1/1

10.47.2.0/29 10.50.250.1 1 A S ethernet1/1

10.47.3.0/29 10.50.250.1 1 A S ethernet1/1

10.47.4.0/26 10.50.250.1 1 A S ethernet1/1

10.47.6.0/24 10.50.250.1 1 A S ethernet1/1

10.50.1.0/24 10.50.250.1 1 A S ethernet1/1

10.50.1.0/26 10.50.1.1 0 A C ethernet1/2

10.50.1.1/32 0.0.0.0 0 A H

10.50.2.0/24 10.50.2.1 0 A C ethernet1/3

10.50.2.0/24 10.50.250.1 1 S ethernet1/1

10.50.2.1/32 0.0.0.0 0 A H

10.50.50.5/32 0.0.0.0 0 A H

10.50.250.0/29 10.50.250.2 0 A C ethernet1/1

10.50.250.2/32 0.0.0.0 0 A H

Re: Palo alto static routing issue

mlinsemier — Tue, 20 Mar 2018 14:42:57 GMT

Is this a dump of show routing fib ? It looks a bit different on my 8.x device? Any chance you have policy based routing configured?

- Matt

Re: Palo alto static routing issue

BigPalo — Tue, 20 Mar 2018 14:59:20 GMT

PanOS version is 6.1.x.

The previous command was "show routing route"

The issue was solved configuring PBR in orfer to force the correct interface. That was done because routes werent working (even with more metric and restrict mask).

Re: Palo alto static routing issue

OtakarKlier — Wed, 21 Mar 2018 21:17:49 GMT

Hello,

The PAN has two routing tables, one for the routes and another for forwarding. The forwarding will be the one that the PAN uses to send the packets. As @mlinsemier pointed out, check out the FIB table as well.

Regards,

Re: Palo alto static routing issue

BigPalo — Thu, 22 Mar 2018 09:41:22 GMT

265 10.0.0.0/8 10.50.50.4 ug ethernet1/5 1500
289 10.47.6.0/24 10.50.250.1 ug ethernet1/1 1500
279 10.47.1.0/29 10.50.250.1 ug ethernet1/1 1500
280 10.47.2.0/29 10.50.250.1 ug ethernet1/1 1500
281 10.47.3.0/29 10.50.250.1 ug ethernet1/1 1500
282 10.47.4.0/26 10.50.250.1 ug ethernet1/1 1500
283 10.50.1.0/24 10.50.250.1 ug ethernet1/1 1500
284 10.50.2.0/24 0.0.0.0 u ethernet1/3 1500
232 10.50.1.0/26 0.0.0.0 u ethernet1/2 1500
231 10.50.1.1/32 0.0.0.0 uh ethernet1/2 1500
234 10.50.2.1/32 0.0.0.0 uh ethernet1/3 1500
261 10.50.50.5/32 0.0.0.0 uh ethernet1/5 1500
218 10.50.250.0/29 0.0.0.0 u ethernet1/1 1500
217 10.50.250.2/32 0.0.0.0 uh ethernet1/1 1500
285 10.128.0.0/16 10.50.250.1 ug ethernet1/1 1500