Query for routing table

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Query for routing table

L2 Linker

Hello, everyone.

One query.

In Palo Alto Firewalls, what is the correct command in the CLI, to "validate" if I have or don't have a route, to reach a particular destination?

The correct command is "show routing route" or "show routing fib" ???

What is the command that can help me to know if my Firewall has a route to a particular destination?

Thanks for your comments.

16 REPLIES 16

L4 Transporter

Hello again,

Your image only gives half the picture, but lets assume the routing table on the 'inside' router also includes the FW Eth1/4 subnet.

 

On the firewall when you issue the 'ping host ...' command, the traffic is sourced on the MGMT interface, the next-hop is the router shown in your screenshot. I'd imagine the the destination subnet 10.7.25.0/24 (?) is also directly routed on this router, you therefore have a routable path with not security policy to get in the way.

When you use the 'ping source <eth1/4_ip> host xx' command, traffic should egress the firewall towards the inside router and then onto the destination subnet, again you have a routable path between the endpoints. The issue you have when sourcing from any interface other than mgmt0 is that an intra-zone policy must exist to permit those flows.

 

Another point that is probably worth looking at is that your mgmt interface is not out-of-band and can be reached by any 'inside' device. Without re-architecting your logical design, I suggest you edit the allowed-hots ACL on that interface to permit access from an operations subnet/ jump box.

 

Please mark this post solved it you feel your original question has been answered.

 

cheers,

Seb.

Wish this command would tell you the actual route entry was being used.I would like the output to reveal that it is using the 0.0.0.0/0 entry in my example. Any ideas?

 

For example,

 

xxxx@xxxx (active)> test routing fib-lookup virtual-router Default ip 8.8.8.8

--------------------------------------------------------------------------------
runtime route lookup
--------------------------------------------------------------------------------
virtual-router: Default
destination: 8.8.8.8
result:
via 172.16.4.10 interface ae1.4, source 172.16.4.1, metric 10
--------------------------------------------------------------------------------

  • 3852 Views
  • 16 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!