Interface Monitoring

[Sujanya]

We have total 3 Interface ,  two ISP interface ( In router we have made them to act as Primary and Secondary) and one trust interface , now the confusion is I am trying to make if both ISP interface goes down , I need to make my trust interface also to goes down automatically by some monitoring feature. Is it possible to do that in Palo-Alto

[BPry]

@Sujanya,

Do you use a routing protocol like BGP or OSPF? If you use a standard Layer3/Layer2 interface and need to actually bring the interface down I think you'd have to script this check instead of being able to have the firewall do this itself. 

[Sujanya]

@BPry ,

Thanks for the response. No we are using static routes only. and we are using layer3 as interface. Don't we have interface monitoring functionality in Palo-Alto.

[BPry]

@Sujanya,

You certainly have link and path monitoring functionality, but that's more of a failover consideration. The firewall isn't going to shutdown an interface due to link monitoring or path monitoring on the route itself. It would either trigger a HA failover or remove the route, not shutdown the interface. 

[Sujanya]

@BPry ,

Thank you so much. I got it.