topic Route selection algorithm in General Topics

Route selection algorithm

Ilya_Kuranov — Mon, 19 Apr 2021 12:23:09 GMT

Hi everyone!

I have a question about PA virtual router logic. For example, I have two static routes

0.0.0.0/0 AD 10 metric 10 next hop 1.1.1.1

0.0.0.0/0 AD 10 metric 10 next hop 2.2.2.2

ECMP disabled. All dynamic routing protocols are disabled.

Which of these two routes will be chosen and why? Does anybody know how the firewall selects the route and which parameters it uses for route selection?

Re: Route selection algorithm

SutareMayur — Mon, 19 Apr 2021 13:38:58 GMT

Hi @Ilya_Kuranov ,

Normally when the PA have multiple routes for the same destination, then firewall gives preference to the route which have lowest AD. Unless you have ECMP enabled on PA you can't add multiple routes for the same destination with same AD value. Now if you are seeing multiple route towards same destination with same AD then ECMP is enabled on the Virtual Router.

Hope it helps!

Re: Route selection algorithm

nikoolayy1 — Mon, 19 Apr 2021 18:03:31 GMT

Better use the Administrative Distance to control the route process :

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/virtual-routers.html

You can use the fib lookup to see which path will be selected:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClYJCA0

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-cli-quick-start/cli-cheat-sheets/cli-cheat-sheet-networking.html

Re: Route selection algorithm

Ilya_Kuranov — Wed, 21 Apr 2021 14:35:38 GMT

You're right. There is no way to create two identical static routes with the same AD with ECMP option disabled. The commit will fail.

Thank you!