Just a note here that I am getting a cosmetic warning during commit of a newly-upgraded PA-220 (my lab box) to PAN-OS 9.0.
Prior to the upgrade, I had a static route in my virtual router, to redirect all traffic going to 192.168.1.0/24 to my tunnel.4 interface (which is an IPSec tunnel to another firewall). The route does not specify a next-hop IP, just to throw it on the tunnel interface and be done with it. This has always worked fine (and still does, in fact), but when I commit, I get the following warning in the commit log:
Again, it's not a problem, but I know a LOT of people do this. It's a cosmetic error, and my routing is still working as-expected. I just wanted to notify people...
COMMIT WARNING: NEXT HOP IP IS NOT IN SUBNET OF OUTGOING INTERFACE
Please look at this KB article.
This is a new check introduced in 9.0 part of the new feature where FQDN can be used as "Next Hop."
An FQDN used as a static route next hop must resolve to an IP address that belongs to the same subnet as the interface you configured for the static route. For consistency, any option used for "Next Hop" will be subjected to this check.
NOTE: This is only a warning and does not cause the commit to fail.
Resolution : Ensure that the next hop must resolve to an IP address that belongs to the same subnet as the interface you configured for the static route.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The LIVEcommunity thanks you for your participation!