static route with path monitor down not removing BGP route

[Clint_UICCU]

Hello,

I am having issues with trying to get failover setup between vendor routers. We have vendor provided routers at our hub site and at one of our branch sites. We would like to have the traffic be routed to the branch vendor router in the event the hub vendor router is offline. I have setup a static route on the hub firewall to the hub vendor router with path monitor. I have setup a static route on the branch firewall to the branch vendor router with no path monitor and the administrative distance higher than BGP. I have the vendor network prefix to redistribute in both the hub and branch in the panorama sdwan devices. The issue I am seeing is when the hub vendor router is offline, path monitor shows it down but the hub firewall route is still being used. The branch firewall is still trying to use the route to the hub firewall and not advertising its static route to the hub.  There must be something I am missing but not where else to look. I have included a generic diagram. 

[JayGolf]

Hi @Clint_UICCU ,

Are you still experiencing this issue?

On the hub:

Confirm the path monitor on the static route to the hub vendor router is actually causing the route to be removed from the hub's routing table when the vendor router is down. If not, the path monitor itself is not functioning as expected and I would recommend going over that config. When path monitoring fails, the static route should be removed from the routing table. Check the RIB and the FIB to ensure its not in play anymore. 

Verify that if the static route is being removed, the hub's BGP redistribution is correctly withdrawing that route from its BGP advertisements.

On the branch:

Ensure the static route to the branch vendor router is correctly redistributed into BGP. Next, verify that the BGP export policy on the branch firewall permits the advertisement of this static route to the hub as well as make sure your higher AD is committed successfully. 

This should point you towards the right direction in figuring out where exactly this process is failing.

[OtakarKlier]

Hello,

Other things to try:

• Policy Based Forwarding. Have a static route that points over the SD-Wan and a Policy Based Forward route that points to the local vendor router. The PBF routes takes effect prior to the default router so it wont mess things up.
• OSPF between your devices. This way the routes are learned and if they go down, then it'll take the best path.

Regards,