Query for routing table

[Matlu_NN]

Hello, everyone.

One query.

In Palo Alto Firewalls, what is the correct command in the CLI, to "validate" if I have or don't have a route, to reach a particular destination?

The correct command is "show routing route" or "show routing fib" ???

What is the command that can help me to know if my Firewall has a route to a particular destination?

Thanks for your comments.

[seb_rupik · Accepted solution]

Hello again,

Your image only gives half the picture, but lets assume the routing table on the 'inside' router also includes the FW Eth1/4 subnet.

On the firewall when you issue the 'ping host ...' command, the traffic is sourced on the MGMT interface, the next-hop is the router shown in your screenshot. I'd imagine the the destination subnet 10.7.25.0/24 (?) is also directly routed on this router, you therefore have a routable path with not security policy to get in the way.

When you use the 'ping source <eth1/4_ip> host xx' command, traffic should egress the firewall towards the inside router and then onto the destination subnet, again you have a routable path between the endpoints. The issue you have when sourcing from any interface other than mgmt0 is that an intra-zone policy must exist to permit those flows.

Another point that is probably worth looking at is that your mgmt interface is not out-of-band and can be reached by any 'inside' device. Without re-architecting your logical design, I suggest you edit the allowed-hots ACL on that interface to permit access from an operations subnet/ jump box.

Please mark this post solved it you feel your original question has been answered.

cheers,

Seb.

[RodO]

Wish this command would tell you the actual route entry was being used.I would like the output to reveal that it is using the 0.0.0.0/0 entry in my example. Any ideas?

For example,

xxxx@xxxx (active)> test routing fib-lookup virtual-router Default ip 8.8.8.8

--------------------------------------------------------------------------------
runtime route lookup
--------------------------------------------------------------------------------
virtual-router: Default
destination: 8.8.8.8
result:
via 172.16.4.10 interface ae1.4, source 172.16.4.1, metric 10
--------------------------------------------------------------------------------