Static route path monitoring doesn't recover

[Dennis-Wu]

Configured the path monitor on my primary ISP route per this guide,

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/static-routes/static-route-remo...

It worked great when I unplug the cable from the primary ISP CPE. The default route went to the back up ISP. Problem is the primary default route doesn't recover  when I put the cable back. I waited till the monitor claim the status is up. But the primary default route  is shown inactive (missing A flag).

BTW: the backup ISP is DHCP with automatically add default route enabled.

[kiwi]

Hi @Dennis-Wu ,

Did you enable preemtion ?

By default, preemption is disabled on the firewalls and must be enabled on both firewalls. When enabled, the preemptive behavior allows the firewall with the higher priority to resume as active or active-primary after it recovers from a failure.

device-priority-and-preemption

Cheers !

-Kiwi.

[BPry]

@Dennis-Wu,

When the monitor claims the status is up is when the preemptive hold timer actually starts counting down to verify the path is stable. By default, this is set to 2 minutes. Did you allow enough time for the preemptive hold timer to pass so the link should have actually become active?

Also important, did you weight the route metrics? 

[Dennis-Wu]

@BPry appreciate your hint. I did wait till the preemptive time finished. And the metric is correct as in the begining before I unplug the primary ISP cable the default route was pointing to the primary ISP correctly.

Update: Found it actually interference with the DHCP type of ISP. I have to disable the "automaticlly create default route" on the interface and use a static route with next hop to the ISP GW. It is not a 100% solution as the ISP GW could change. But I can live with it for now

[AlexandroDelAngel]

Hi @BPry ,

Do you know by any chance if there´s a way to monitor via CLI the count down of the preemptive hold timer? I just started supporting a deployment where the prior integrator configured 60 minutes of preemption, so at least I would like to know if the timer is actually counting down or not.

Thanks in advance!

[OtakarKlier]

Hello,

For this scenario, I usually utilize Policy Based Forwarding. Pretty much the same thing, however PBF happens before the virtual routers data so its always first.

Just a thought.

[acastillo890]

I am having the same issue. Even when I attempt to perform the same ping ingress and egress from both firewalls the pings are successful. Both sides are Palo Alto's in my case.