static routes for 2 wan links with DHCP dynamic IPs

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

static routes for 2 wan links with DHCP dynamic IPs

L3 Networker

Hi everyone,

 

I would like to ask for some assistance in my configuration, the palo alto firewall has been so far a pretty frustrating experience, I guess due to my lack of knowledge of Pas

 

i have 2 wan dhcp dynamic ips links

 

I would like to implement some redundancy

if 1 link goes down - the second link activates and when the primary goes back, it failovers back 

 

very simple setting

 

I hav dhcp enabled on both interfaces and I have disabled "automatically install the default route from the isp"

I went to logical routes and created:

a static route 1  with metric 10 : 0.0.0.0/0 --> next hope "none" and interface being the wan 1 (I have a dynamic next hop, so i cannot point to the temp gateway)

a static route 2  with metric 200 : 0.0.0.0/0 --> next hope "none" and interface being  the wan 2 I have a dynamic next hop, so i cannot point to the temp gateway)

enabled route  monitoring and after installing I get

Path monitoring failed for static route destination 0.0.0.0/0 with next hop ethernet1/2. Route removed.
11/04 06:04:28
Path monitoring failed for static route destination 0.0.0.0/0 with next hop ethernet1/1. Route removed.

 

so obviously after that internet is not working

 

can you please advise what do i do wrong, why the PA cannot identity the next hop dinamically via the interface it was told to use??

 

thank you 

 

2 REPLIES 2

Cyber Elite
Cyber Elite

Static route you try to configure will be removed from virtual router only if interface physically goes down.

If you would have static IPs from ISP you could set up path monitoring inside the static route.

 

What you are trying to accomplish is as good as leaving "automatically install the default route from the isp" in place and setting route metric on one DHCP interface to 10 and 200 on other.

 

Raido_Rattameister_0-1699061520588.png

 

You can't configure path monitoring if your interface don't have IP.

 

Theoretically you could wait for DHCP to pick up gateway IP and then set up PBF with next hop to that gateway IP.

And then second PBF under first one towards secondary ISP.

If your ISP don't change subnet then gateway should be more or less the same all the time.

 

As PBF is processed before virtual router if there is matching PBF then virtual router is bypassed.

 

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Thank you for your reply 

I will use your suggestion, would you know how in this case configure the static router for sdwan? Thank you 

 

  • 1052 Views
  • 2 replies
  • 0 Likes
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!