Routed Protocols:

o Routed protocols are the actual data that is transferred from router to router.
o Examples of routed protocols are Internet Protocol (IP) such as IPV4 and IPV6.
o Routed Protocol is used to send user data from one network to another network.
o Routed Protocol carries user traffic such as e-mails, file transfers, web traffic etc.
o Used between routers to direct user traffic, it is also called network protocols.
o That are signs at intersections that point to nearby cities, giving mileage to each.

Routing Protocols:
o Routing protocols are used by routers to exchange information about known networks.
o Routers will initially only know the existence of directly connected networks.
o With the use of routing protocols routers communicate with & learn from other routers.
o Routing protocols are used to distribute routing information across routers on a network.
o Routing protocol is Google Maps: It tells you the best way to get where you want to go.
Routed Protocol Routing Protocols
IP, IPV4, IPV6 RIPV2, OSPF,BGP

1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

Connected:
o Connected routes are IP Subnet belonging to Firewall interfaces itself.
o All interfaces configured in the Firewall will belong to this category.
o Connected are the most commonly routes used for Redistribution.
o any /32 interface configured on Firewall are not considered Connected.
o Any /32 interface is consider Host, and therefore cannot be redistributed.

Static Routing:
o Static Routing administrator manually inputs all routing table information.
o A static route is a route that is created manually by a network administrator.
o Router's routing table entries are populated manually by network administrator.
o Static route tells the network devices about exact location for the routes.
o Static routes are typically and can only be used in smaller networks.
o Configure static routes between devices to allow data transfer between devices.
o Major advantages of static routing are reduced routing protocol router overhead.
o Another advantage of static routing it reduced routing protocol network traffic.
o Disadvantages of static routing are network changes require manual reconfiguration.
o Easy to Configure, High Secure, Use Low Resources, Bandwidth & in small network.
o In PA Static Routing does not require Advanced Knowledge to configure them.
o By default, in PA Firewall the static routes have an Administrative Distance of 10.

Default Routing:
o A Default Route also known as the gateway of last resort is a special type of static route.
o This method where all routers are configured to send all packets towards single device.
o Default Route is network route used by device when there is no other known route exists.
o All the IP datagrams with unknown destination address are sent to the default route.

2 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

Dynamic Routing:
o Dynamic routing protocols can dynamically respond to changes in the network.
o Routing protocol is configured on each device & device learn about both each other.
o Dynamic routing table is created, maintained and updates by routing protocol.
o Examples of Dynamic routing protocols includes RIPv2, OSPFV3 and OSPF and BGP.
o Dynamic routing protocols share routing updates with neighbors and find best path.
o Dynamically choose a different route if a link goes also updates are dynamically.
o Also, Dynamic Protocols has the ability to load balance between multiple links.
o Dynamic Routing protocols put additional load on devices CPU and RAM.
o The choice of the best route is on the hands of the Dynamic Routing Protocol.

Administrative Distance:
o Administrative distance is the feature that routers use to select best path.
o Administrative Distance (AD) defines the reliability of a routing protocol.
o The administrative Distance (AD) number is start from 0 and end on 240.
o AD has only local significance and is not advertised in routing updates.
o The smaller Administrative Distance value, the more reliable the protocol.
o In multiple routing protocols, AD is used to determine trustable protocol.
o Routing Protocol with lowest Administrative Distance wins put in routing table.
o Administrative distance of 255 will cause the router to Disbelieve route entirely.
o AD value of 255 router disbelieve & will be excluded from route selection process.
o AD are set from Network > Virtual Routers > vr_name > General screen & are applicable.
Administrative Distances
Static Routes Range is 10-240 Default is 10
OSPF Internal Range is 10-240 Default is 30
OSPF External Range is 10-240 Default is 110
IBGP Range is 10-240 Default is 200
EBGP Range is 10-240 Default is 20
RIP Range is 10-240 Default is 120

3 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

Route Metric:
o The Route Metric is similar to AD in helping to select or predict the best route.
o However, route metrics are only applicable within a single routing protocol.
o Route Metric are not used when forwarding traffic through multiple protocols.
o To forwarding traffic through multiple protocols Administrative Distance is used.
o Route Metric on Palo Alto Firewalls can be set to determine the route selection.
o The Route Metric is used when there are multiple paths to the same destination.
o In Palo Alto Network Firewall Lower metric values are preferred over higher values.
Protocol or Route Type Valid Range
Static Route Metric 1 - 65535
OSPF Interface Metric 1 - 65535
BGP Local Preference 0 - 4294967295
BGP MED Metric 0 - 4294967295
BGP Weight 0 – 65535
RIPv2 Metric 1 – 16

RIB:
o RIB is a PA Firewall term which is stand for Routing Information Base.
o All routes learned are first place in the Routing Information Base (RIB).
o Show routing route, command will display the RIB table from the Firewall.
o All the routes that are “active” are marked with an “A” in the flags column.

4 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

FIB:
o FIB is a PA Firewall term which is stand for Forwarding Information Base.
o Best route obtained through protocols are used to populate the firewall’s FIB.
o Show routing fib, command will display the FIB table from the PA Firewall.
o Firewall chooses the best route toward destination network to place in the FIB.

Redistribute:
o Redistribute Rule allows to “Redistribute” route from one protocol into another.
o Redistribution allows devices to share routes info among routing protocols.
o Redistribution profiles are only way to exchange routing info between protocols.
o Palo Alto Firewalls provide flexible, profile-based approach for route redistribution.
o PA Firewall also provide filtering between protocols, static routes, connected & hosts.
o In PA Firewall Without redistribution profiles, each protocol functions on its own.
o Does not exchange any route info with other protocols running on same virtual router.
o Redistribute static route into dynamic routing protocol like OSPF is common use case.

5 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

Virtual Routers:
o When it comes to routing traffic between different networks one needs a Router.
o Palo Alto Networks Firewalls are capable of routing the traffic between networks.
o Uses concept of “Virtual Routers” to route traffic be it static or dynamic routing.
o Virtual Router uses virtualized or partitioned routing tables to do the routing job.
o Uses virtual routers to obtain routes & uses best route to populates its routing table.
o PA Firewall capable of supporting Dynamic routing protocols like RIPv2, OSPF & BGPv4.
o The Palo Alto NG Network Firewalls comes with a Virtual router named the default.
o Can be used for routing provided layer3 interfaces or VLANs are part of that default VR.
o Can also create new Virtual Router & name & use it for both static & dynamic routing.
o In Palo Alto Firewall Layer 3 deployment, the Firewall routes traffic between ports.
o Each L3, loopback interface, & VLAN interface must be associated with Virtual Router.
o In Palo Alto Network Firewall each interface can belong to only one Virtual Router.
o IP must be assigned to each interface & virtual router must be defined to route traffic.
o PA Firewall can create multiple virtual routers, each maintaining separate set of routes.
o An Addition to adding static routes, can configure to participate with dynamic routing.
o Virtual Routers used for Layer 3 IP routing and also supports one or more static routes.

6 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

Network > Virtual Routers > Router Settings > General

Settings Description
Name Specify a name to describe the Virtual Router.
Interfaces Select the interfaces that want to include in the Virtual Router.
Administrative Distances Specify the Administrative Distances.

Administrative Distances
Static Routes Range is 10-240 Default is 10
OSPF Internal Range is 10-240 Default is 30
OSPF External Range is 10-240 Default is 110
IBGP Range is 10-240 Default is 200
EBGP Range is 10-240 Default is 20
RIP Range is 10-240 Default is 120

Network -> Virtual Routers -> Add Type name “VR-WAN” -> click OK

7 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

Let’s configure Static Rout; I will route all traffic to ISP (Default Route); assuming that the ISP
router IP address is [Link]
Static Routes –> Add
Type name, select the Interface (ethernet1/1) and Next Hop keep the default Metric 10
You will need to click “Commit” then the changes take effect.

8 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

 Settings Description
Name Enter a name to identify the static route .
Destination Enter an IP address and network mask in Classless Inter-domain
Routing (CIDR) notation for example, [Link]/24
Interface Select the interface to forward packets to the destination, or configure
the next hop settings, or both.
Next Hop Select one of the following:
IP Address—Select to enter the IP address of the next hop router.
Next VR—Select to select a virtual router in the firewall as the next
hop. To route internally between virtual routers within a single firewall.
Discard—Select if want to drop traffic that is addressed to destination.
None—Select if there is no next hop for the route.
Admin Distance Specify administrative distance for static route (10-240; default is 10).
Metric Specify a valid metric for the static route (1 - 65535).
Route Table Select the route table into which the firewall installs the static route:
Unicast—Installs the route into the unicast route table.
Multicast—Installs the route into the multicast route table.
Both—Installs the route into the unicast and multicast route tables.
No Install—Does not install the route in the route table (RIB).
BFD Profile To enable Bidirectional Forwarding Detection (BFD) for static route.
default (default BFD settings)
A BFD profile that you have created on the firewall
New BFD Profile to create a new BFD profile
Select None (Disable BFD) to disable BFD for the static route.
To use BFD on a static route: Both firewall & peer at opposite end of
static route must support BFD sessions. Static route Next Hop type
must be IP Address & must enter valid IP address.
The Interface setting cannot be None; you must select an interface.
Path Monitoring Select to enable path monitoring for the static route.
Failure Condition Select the condition under which the firewall considers the monitored
path down and thus the static route down:
Any—If any one of the monitored destinations for the static route is
unreachable by ICMP.
All—If all of the monitored destinations for the static route are
unreachable by ICMP.
Select All to avoid the possibility of a single monitored destination
signaling a static route failure when that monitored destination is
simply offline for maintenance, for example.
Preemptive Hold Enter the number of minutes a downed path monitor must remain in
Time (min) Up state— Range is 0-1,440; default is 2.
Name Enter a name for the monitored destination.
Enable Select to enable path monitoring of this specific destination for the
static route; the firewall sends ICMP pings to this destination.

9 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

 Source IP Select the IP address that the firewall will use as the source in the ICMP
ping to the monitored destination:
Destination IP Enter IP address for which the firewall will monitor the path.
Ping Interval (sec) Specify ICMP ping interval in seconds to determine how frequently
firewall monitors path range is 1-60; default is 3.
Ping Count Specify number of consecutive ICMP ping packets that do not return
from the monitored destination before firewall considers link down.

More Runtime Stats for a Virtual Router:

After configuring static routes or routing protocols for a virtual router, select Network > Virtual
Routers, and select More Runtime Stats in the last column to see detailed information about
the virtual router, such as the route table, forwarding table, and the routing protocols and
static routes you configured.

10 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717

 Route Table Flags and Description
Flags Description
A?B Active and learned via BGP
AC Active and a result of an internal interface (connected) - Destination = network
AH Active and a result of an internal interface (connected) - Destination = Host only
AR Active and learned via RIP
AS Active and Static
S Inactive (Because this route has a higher metric) and static
01 OSPF external type-1
O2 OSPF external type-2
Oi OSPF intra-area
Oo OSPF inter-area

Forwarding Table Flags and Description

Flags Description
u Route is up.
h Route is to a host.
g Route is to a gateway.
e Firewall selected this route using Equal Cost Multipath.
* Route is the preferred path to a destination network.
ug Route is up and a gateway.
uh Route is up and a host.

11 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@[Link] , Mobile: 056 430 3717