1.2 Advanced Routing Engine, Logical Routers & Dynamic Routing

1.2 Advanced Routing Engine, Logical Routers & Dynamic Routing

The Evolution to the Advanced Routing Engine (PAN-OS 10.2+)

In PAN-OS 10.2, Palo Alto Networks introduced the Advanced Routing (AR) engine, representing a fundamental architectural evolution from legacy Virtual Routers.

Legacy Virtual Routers vs. Advanced Routing Architecture

• Legacy Virtual Routers (VR): Relied on a monolithic routing daemon (routed) executing on the Management Plane. While feature-rich, the legacy engine suffered from scalability constraints in massive multi-tenant topologies, lacked native VRF constructs, had limited support for advanced BGP community manipulations, and required manual multi-protocol synchronization.
• Advanced Routing Engine (AR): Built upon a modern, modular routing microservices architecture (integrating industry-standard FRRouting components). AR decouples routing protocols into dedicated, fault-tolerant sub-daemons, delivering cloud-scale routing performance, true VRF-based multi-tenancy, and deterministic convergence times.

Legacy Virtual Router:
+-----------------------------------------------------------+
| Management Plane: monolithic "routed" daemon              |
| [ BGP ] <---> [ OSPF ] <---> [ RIP ] <---> [ Static/RIB ] |
+-----------------------------------------------------------+

Advanced Routing Engine (PAN-OS 10.2+):
+-----------------------------------------------------------+
| Management Plane: Modular Microservices Stack (FRR Core)  |
| [ bgpd ]     [ ospfd ]     [ ospf6d ]     [ bfdd ]        |
|    |             |             |             |            |
|    +-------------+-------------+-------------+            |
|                          v                                |
|        [ Logical Router Engine / VRF Manager ]            |
+-----------------------------------------------------------+

Exam Trap Alert: Enabling Advanced Routing is a global system change. Transitioning between legacy Virtual Routers and the Advanced Routing engine is executed via the CLI command set system setting advanced-routing enable (or disable) and strictly requires a complete system reboot. During migration, existing virtual-router configuration trees are automatically converted into logical-router configuration hierarchies.

---

Logical Router (LR) Architecture & VRF Segmentation

When Advanced Routing is enabled, the firewall organizes routing through Logical Routers (LR).

1. VRF-Lite Support: A single Logical Router can contain multiple VRF (Virtual Routing and Forwarding) instances. Each VRF maintains its own isolated Routing Information Base (RIB), Forwarding Information Base (FIB), and independent dynamic routing protocol sessions.
2. Interface Association: Layer 3 physical interfaces, 802.1Q subinterfaces, loopback interfaces, and tunnel interfaces are mapped directly to a specific VRF within a Logical Router.
3. Inter-VRF Route Leaking: Routes can be leaked between VRF tables using administrative route target/import policies, or traffic can exit one VRF interface and enter another VRF across distinct Security Zones, maintaining Layer 7 inspection between tenants.

---

Border Gateway Protocol (BGP-4) Mechanics

PAN-OS Advanced Routing provides carrier-grade BGP-4 and Multiprotocol BGP (MP-BGP) capabilities.

1. eBGP vs. iBGP Operation

• External BGP (eBGP): Connects peers in differing Autonomous Systems. By default, eBGP packets are transmitted with an IP Time-To-Live (TTL) of 1. If peering over loopback interfaces or multi-hop topologies, eBGP Multihop must be explicitly configured with an appropriate TTL value.
• Internal BGP (iBGP): Connects peers within the same Autonomous System. To prevent routing loops, iBGP enforces the Split-Horizon Rule: an iBGP router will never advertise a route learned via iBGP to another iBGP peer. Traditionally, this required a full mesh ($N(N-1)/2$ peerings).

2. Route Reflectors (RR)

To eliminate full-mesh iBGP constraints, PAN-OS can be configured as a BGP Route Reflector:

• The firewall reflects routes received from RR Clients to all other clients and non-clients.
• Routes received from non-clients are reflected only to RR clients.
• Prevents loops by appending the Originator-ID (Router ID of the route advertiser) and prepending its Cluster-ID to the CLUSTER_LIST attribute.

3. AS Path Prepending for Inbound Traffic Control

While BGP Local-Preference dictates outbound path selection, inbound path selection is controlled by upstream networks. To influence inbound traffic without AS filter agreements, engineers utilize AS Path Prepending:

• In outbound BGP export rules, the administrator artificially appends the local Autonomous System Number multiple times (e.g., 65001 65001 65001).
• When external peers evaluate paths, the prepended route appears significantly longer, causing them to select the non-prepended secondary path as the preferred ingress route.

4. PAN-OS BGP Best Path Selection Hierarchy

When multiple paths exist for a given prefix, the Advanced Routing engine selects the best route using the following sequence:

1. Highest Weight (PAN-OS proprietary, local to the firewall).
2. Highest Local Preference (exchanged throughout the local AS; default 100).
3. Locally Originated (network statement or redistribution).
4. Shortest AS_PATH (number of ASNs in the path; influenced by AS Path Prepending).
5. Lowest Origin Type (IGP < EGP < Incomplete).
6. Lowest Multi-Exit Discriminator (MED) (exchanged between adjacent ASes).
7. eBGP over iBGP (eBGP routes preferred over iBGP routes).
8. Lowest IGP metric to the BGP next-hop address.
9. Oldest Route (for eBGP paths; maximizes stability).
10. Lowest BGP Router ID (RID).

---

Open Shortest Path First (OSPFv2 & OSPFv3)

PAN-OS supports OSPFv2 (RFC 2328) for IPv4 and OSPFv3 (RFC 5340) for IPv6.

Area Types & LSA Filtering

• Backbone Area (Area 0 / 0.0.0.0): The mandatory core transit area to which all other areas must physically or virtually connect.
• Standard Area: Propagates all router, network, and summary LSAs (Types 1, 2, 3) as well as external LSAs (Types 4 and 5).
• Stub Area: Suppresses AS External LSAs (Type 4 and 5). The Area Border Router (ABR) injects a default route via a Type 3 Summary LSA.
• Totally Stubby Area: Suppresses both external LSAs (Types 4 and 5) and summary LSAs (Type 3). The ABR injects a single Type 3 default route.
• Not-So-Stubby Area (NSSA): Allows external routes to be imported by an internal ASBR as Type 7 LSAs. The ABR converts Type 7 LSAs into Type 5 External LSAs when flooding into Area 0.
• Totally NSSA: Blocks Type 3 summary LSAs while allowing Type 7 external route generation.

DR/BDR Election Mechanics

On broadcast (e.g., Ethernet) and Non-Broadcast Multi-Access (NBMA) networks, OSPF routers elect a Designated Router (DR) and Backup Designated Router (BDR) to minimize adjacency overhead:

• Priority Range: 0 to 255. A priority of 0 permanently disqualifies the router from the election (forces DROTHER state).
• Election Winner: The eligible router with the highest interface priority wins. In the event of a tie, the router with the highest Router ID (RID) wins.
• Non-Preemptive Nature: Once an active DR is elected, the role is non-preemptive. Introducing a newly booted firewall with priority 255 will not usurp an active DR with priority 1 until the existing DR fails or its OSPF process is manually restarted.

---

Equal-Cost Multi-Path (ECMP) Routing & Load-Balancing

PAN-OS supports Equal-Cost Multi-Path (ECMP), enabling installation of multiple parallel equal-cost paths in the FIB. The Max Path setting accepts 2, 3, or 4 copied routes per destination network, and the default is 2 — there is no higher setting on any platform, so a design needing more than four active paths must load-balance elsewhere.

Load-Balancing Hash Algorithms

1. IP Modulo: Performs a mathematical modulo operation on the destination IP address against the number of active paths. Fast, but vulnerable to polarization across multi-tier networks.
2. IP Hash: Computes a hash based on source IP and destination IP addresses (and optionally Layer 4 ports), ensuring balanced session distribution across diverse host pairs.
3. Balanced Round Robin: Sequentially assigns each new incoming session to the next available equal-cost next hop.
4. Symmetric Return (Critical Stateful Feature): Guarantees that return packets belonging to an existing session exit via the exact same interface on which the initial inbound packet arrived.

Exam Trap Alert: In multi-homed ISP environments with ECMP enabled, failing to enable Symmetric Return frequently causes asymmetric routing drops. When return packets arrive on an unexpected interface, stateful inspection drops the traffic due to out-of-state TCP sequence anomalies, or upstream ISPs drop packets via Unicast Reverse Path Forwarding (uRPF / BCP 38).

---

Static Routes, Administrative Distance & Path Monitoring

When dynamic routing is not utilized, PAN-OS relies on static routes evaluated against Administrative Distance (AD):

Floating Static Routes

A Floating Static Route provides automatic backup for a primary static or dynamic route. It is configured with an Administrative Distance higher than the primary route (e.g., AD of 120 backing up an OSPF route with AD 30). The floating route remains inactive in the RIB and is never programmed into the FIB until the primary route disappears.

Static Route Path Monitoring

Normally, a static route remains active in the FIB as long as the local egress interface link is physically UP. If an upstream ISP gateway fails three hops away, the firewall continues black-holing traffic.

Path Monitoring solves this limitation:

• Configured under the static route configuration.
• Proactively transmits ICMP echo requests through the designated egress interface to one or more monitoring destinations (e.g., upstream gateway or public DNS 8.8.8.8).
• Health Parameters: Ping interval (default 3 seconds), ping count (default 5 missed probes).
• Failure Condition: Set to Any (fail if any target drops) or All (fail only if all targets drop).
• Withdrawal Action: If the condition is met, PAN-OS immediately marks the static route as unreachable and withdraws it from the FIB, allowing a secondary or floating route to install instantly without waiting for physical link-down.

+-------------------+           +---------------+           +---------------+
|  PA-3410 Firewall |           | ISP Fiber NTU |           | Upstream Core |
|                   |  Link UP  | (Local Link)  |  FAILURE  |  (Hop 3)      |
| ethernet1/1 ------>-----------+---- UP ------->==== X ====+  DOWN         |
+-------------------+           +---------------+           +---------------+
          |
          +--- Path Monitoring ICMP Ping Target: 8.8.8.8 (FAILED)
          |
          v
   [Action: Withdraw Primary Default Route (AD 10) from FIB]
          |
          v
   [Action: Inject Floating Static Route via ethernet1/2 (AD 20) into FIB]

---

Route Redistribution Profiles & RIB/FIB Synchronization

A Redistribution Profile acts as a policy filter governing the export of routes from one protocol or source into another (e.g., redistributing Connected and Static subnets into BGP).

• Filter Criteria: Matches by Source Protocol, Destination Subnet, Route Type (OSPF intra-area, inter-area, ext-1, ext-2), Interface, and Next Hop.
• Applied Actions: Sets metric, metric type (OSPF Type 1 vs. Type 2), BGP communities, and route tags.

RIB vs. FIB Synchronization Architecture

1. Routing Information Base (RIB): Resides in Management Plane memory. Every dynamic routing protocol daemon and static route injector populates its candidate routes into the master RIB. The RIB evaluates Administrative Distance and metrics to elect a single best route per destination prefix.
2. Forwarding Information Base (FIB): Once elected, best routes are compiled and pushed down to the Data Plane hardware (NPE). The FIB is an optimized lookup table stored in high-speed hardware memory (TCAM/SRAM).
3. Hardware Forwarding Independence: Forwarding decisions, longest prefix match lookups, and session egress evaluations execute purely on the Data Plane using the FIB. A routing engine recomputation or commit operation on the MP never interrupts active line-rate FIB forwarding.

---

Essential CLI Verification Commands

# Display the active IP routing table (RIB)
admin@PA-3410> show routing route

# Display the hardware Forwarding Information Base (FIB) installed on the Data Plane
admin@PA-3410> show routing fib

# Verify BGP neighbor peering states, prefixes received, and uptime
admin@PA-3410> show routing protocol bgp summary

# Verify OSPF neighbor adjacencies, interface roles (DR/BDR/DROTHER), and states
admin@PA-3410> show routing protocol ospf neighbor

# Test and simulate a live FIB lookup for a specific destination IP address
admin@PA-3410> test routing fib-lookup virtual-router default ip 198.51.100.25