Two static routes to one destination with the same metric
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
Where two routes share a destination, a metric and an administrative distance, the configuration states no preference between them. Which one the device installs is decided by tie-breaking a reviewer cannot see, so the intended path is unclear and an operator changing one route may not affect traffic at all.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Decide which path is primary and give it the lower metric.
- Give the backup path a higher metric so it becomes a floating static route.
- Where both paths are meant to share load, record that intent in the route description.
Command line
PAN-OS CLI
set network virtual-router <virtual-router> routing-table ip static-route <route-name> metric <metric>An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.
Read it back
show network virtual-router <virtual-router> routing-table ip static-routeValues to fill in3
- <virtual-router>
- The virtual router
- <route-name>
- The static route to change
- <metric>
- The metric that decides which route is used
Before you type it1
- Changing a metric changes which path traffic takes.
How to confirm the fix
- Confirm the routing table shows the intended route as preferred after the change.
Limits
- Routes with different metrics are not reported. A floating static route is the standard way to configure a backup path and is not a defect.
- This reads the configured route only. Metric and administrative distance are compared as configured.
Compliance references
No benchmark recommendation is mapped to this control in this version.
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.