Static route path monitoring doesn't recover

Reply
Highlighted
L0 Member

Static route path monitoring doesn't recover

Configured the path monitor on my primary ISP route per this guide,

 

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/static-routes/static-route-remo...

 

It worked great when I unplug the cable from the primary ISP CPE. The default route went to the back up ISP. Problem is the primary default route doesn't recover  when I put the cable back. I waited till the monitor claim the status is up. But the primary default route  is shown inactive (missing A flag).

 

BTW: the backup ISP is DHCP with automatically add default route enabled.

Tags (2)
Highlighted
Community Team Member

Re: Static route path monitoring doesn't recover

Hi @Dennis-Wu ,

 

Did you enable preemtion ?

 

By default, preemption is disabled on the firewalls and must be enabled on both firewalls. When enabled, the preemptive behavior allows the firewall with the higher priority to resume as active or active-primary after it recovers from a failure.

 

device-priority-and-preemption

 

Cheers !

-Kiwi.

Highlighted
Cyber Elite

Re: Static route path monitoring doesn't recover

@Dennis-Wu,

When the monitor claims the status is up is when the preemptive hold timer actually starts counting down to verify the path is stable. By default, this is set to 2 minutes. Did you allow enough time for the preemptive hold timer to pass so the link should have actually become active?

Also important, did you weight the route metrics? 

Highlighted
L0 Member

Re: Static route path monitoring doesn't recover

@BPry appreciate your hint. I did wait till the preemptive time finished. And the metric is correct as in the begining before I unplug the primary ISP cable the default route was pointing to the primary ISP correctly.

 

Update: Found it actually interference with the DHCP type of ISP. I have to disable the "automaticlly create default route" on the interface and use a static route with next hop to the ISP GW. It is not a 100% solution as the ISP GW could change. But I can live with it for now

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!