Route selection algorithm

[Ilya_Kuranov]

Hi everyone!

I have a question about PA virtual router logic. For example, I have two static routes

0.0.0.0/0 AD 10 metric 10 next hop 1.1.1.1

0.0.0.0/0 AD 10 metric 10 next hop 2.2.2.2

ECMP disabled. All dynamic routing protocols are disabled.

Which of these two routes will be chosen and why? Does anybody know how the firewall selects the route and which parameters it uses for route selection?

[SutareMayur · Accepted solution]

Hi @Ilya_Kuranov ,

Normally when the PA have multiple routes for the same destination, then firewall gives preference to the route which have lowest AD. Unless you have ECMP enabled on PA you can't add multiple routes for the same destination with same AD value. Now if you are seeing multiple route towards same destination with same AD then ECMP is enabled on the Virtual Router.

Hope it helps!

[nikoolayy1]

Better use the Administrative Distance to control the route process :

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/virtual-routers.html

You can use the fib lookup to see which path will be selected:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClYJCA0

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-cli-quick-start/cli-cheat-sheets/cli-cheat-sheet...

[Ilya_Kuranov]

You're right. There is no way to create two identical static routes with the same AD with ECMP option disabled. The commit will fail.

Thank you!