Static Routes
Table of Contents
Expand all | Collapse all
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > Devices
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > Mobile Network Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Decryption > Forwarding Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Setup > DLP
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
- Device > Device Quarantine
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Certificate Management > SSH Service Profile
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
- Device > Policy Recommendation
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Server Profiles > SCP
- Panorama > Scheduled Config Export
End-of-Life (EoL)
Static Routes
- Network > Virtual Routers > Static Routes
Optionally add one or more static routes. Click the IP or IPv6 tab
to specify the route using an IPv4 or IPv6 address. It is usually
necessary to configure default routes (0.0.0.0/0)
here. Default routes are applied for destinations that are otherwise
not found in the virtual router’s routing table.
Static Route Settings | Description |
---|---|
Name | Enter a name to identify the static route
(up to 63 characters beginning with PAN-OS 10.0.8). The name is
case-sensitive and must be unique. Use only letters, numbers, spaces,
hyphens, and underscores. |
Destination | Enter an IP address and network mask in
Classless Inter-domain Routing (CIDR) notation: ip_address/mask (for
example, 192.168.2.0/24 for IPv4 or 2001:db8::/32 for IPv6). Alternatively,
you can create an address object of type IP Netmask. |
Interface | Select the interface to forward packets
to the destination, or configure the next hop settings, or both. |
Next Hop | Select one of the following:
|
Admin Distance | Specify the administrative distance for
the static route (10-240; default is 10). |
Metric | Specify a valid metric for the static route
(1 - 65535). |
Route Table | Select the route table into which the firewall
installs the static route:
|
BFD Profile | To enable Bidirectional Forwarding Detection
(BFD) for a static route on a PA-3200 Series, PA-5200 Series, PA-7000
Series, or VM-Series firewall, select one of the following:
Select None (Disable BFD) to
disable BFD for the static route. To use BFD on a static route:
|
Path Monitoring | Select to enable path monitoring for the
static route. |
Failure Condition | Select the condition under which the firewall
considers the monitored path down and thus the static route down:
|
Preemptive Hold Time (min) | Enter the number of minutes a downed path
monitor must remain in Up state—the path monitor evaluates all of
its member monitored destinations and must remain Up before the
firewall reinstalls the static route into the RIB. If the timer
expires without the link going down or flapping, the link is deemed
stable, path monitor can remain Up, and the firewall can add the
static route back into the RIB. If the link goes down or flaps
during the hold time, path monitor fails and the timer restarts
when the downed monitor returns to Up state. A Preemptive
Hold Time of zero causes the firewall to reinstall the
static route into the RIB immediately upon the path monitor coming
up. Range is 0-1,440; default is 2. |
Name | Enter a name for the monitored destination
(up to 31 characters). |
Enable | Select to enable path monitoring of this
specific destination for the static route; the firewall sends ICMP
pings to this destination. |
Source IP | Select the IP address that the firewall
will use as the source in the ICMP ping to the monitored destination:
|
Destination IP | Enter a robust, stable IP address or address
object for which the firewall will monitor the path. The monitored
destination and the static route destination must use the same address
family (IPv4 or IPv6) |
Ping Interval (sec) | Specify the ICMP ping interval in seconds
to determine how frequently the firewall monitors the path (pings
the monitored destination; range is 1-60; default is 3). |
Ping Count | Specify the number of consecutive ICMP ping
packets that do not return from the monitored destination before
the firewall considers the link down. Based on the Any or All failure
condition, if path monitoring is in failed state, the firewall removes
the static route from the RIB (range is 3-10; default is 5). For
example, a Ping Interval of 3 seconds and Ping Count of 5 missed
pings (the firewall receives no ping in the last 15 seconds) means
path monitoring detects a link failure. If path monitoring is in failed
state and the firewall receives a ping after 15 seconds, the link
is deemed up; based on the Any or All failure
condition, path monitoring to Any or All monitored
destinations can be deemed up, and the Preemptive Hold Time starts. |