Static Subnets to be redistributed to BGP

[yuyingchenk]

Hi Everyone, 

I am new to PA, at the moment I have got a virtual PA: 

- ethernet1/1 (Internal zone) connects to Internal router (run iBGP between)

- ethernet1/2 (Internet zone) connects to Internet router (run eBGP between)

- Setup static 1-to-1 NAT on PA, between zone Internal and Internet, NAT subnet is 203.x.x.x/24

- Setup GlobalProtect on loopback.1 interface with IP 203.x.x.1/24, Internet zone

- Setup GlobalProtect pool subnet 192.168.2xx.0/24, with tunnel.5 interface (192.168.2xx.254), VPN zone

I would like to advertise the following subnets, with the given conditions:

- PA advertise DMZ 203.x.x.x/24 to Internet router ONLY if PA keep the connection with Internal router

- PA advertise GlobalProtect pool subnet 192.168.2xx.0/24 to Internal router ONLY if PA keeps the connection with Internet router

What I have done: 

- Create 2 static routes for DMZ 203.x.x.x/24

          - static route with AD 10, interface ethernet1/2 without next-hop (this route intends to tell FW where is DMZ subnet)

          - static route with AD 20, interface ethernet1/1 without next-hop, and apply a path monitoring entry, monitor ping from PA to internal network (this route is intended for BGP advertisement, it will be removed from the route table if connection between PA and internal router is DOWN)

- Create 1 staitc route for GlobalProtect pool 192.168.2xx.0/24

          - static route with AD 20, interface ethernet1/1 without next-hop, and apply a path monitoring entry, monitor ping from PA to Internet network (this route is intended for BGP advertisement, it will be removed from the route table if connection between PA and internet router is DOWN)

          - PA has got a connected rotue (AD 0) for 192.168.2xx.0/24 as per tunnel.5 interface

- Create redistribution profiles for DMZ and GlobalProtect pool subnet separately

- Within BGP, add required export rules and redis rules

I have tested the route advertisement & link up/down, it works as expected ... however, I am not 100% confident as I am not sure if this way has any unforeseen issue. Any suggestions are welcome, many thanks.