How to Configure a Virtual Router and Default Route on Palo Alto Firewall

A firewall cannot forward traffic to external destinations without proper Layer 3 routing configuration. While security policy rules determine if traffic is allowed, the routing table determines where packets travel next. In PAN-OS, routing decisions take place inside logical routing instances known as Virtual Routers.

Mastering Palo Alto virtual router configuration is essential for every network engineer setting up a new firewall deployment. A Virtual Router functions as a distinct router inside the firewall. It maintains its own routing table, supports dynamic routing protocols, and manages static routes. This tutorial walks through configuring a Virtual Router, assigning physical interfaces, and creating a default static route to route local traffic to an ISP gateway.

Real-Life Scenario

Consider a typical enterprise branch office deployment. The local corporate network uses the IP subnet 192.168.10.0/24. Internal hosts connect to an internal interface assigned to the Trust security zone.

The branch office connects to an Internet Service Provider (ISP) through an external interface assigned to the Untrust security zone. The ISP provides a public IP subnet (using the documentation range 198.51.100.0/24) with an upstream gateway address of 198.51.100.1.

The business requirements for this firewall deployment are simple:

• Route all internal traffic originating from 192.168.10.0/24 out to the internet through the ISP gateway.
• Isolate interface routing table functions inside a clear, named Virtual Router instance.
• Provide complete visibility into route selection, routing table lookups, and forwarding state for rapid troubleshooting.

Lab Topology

The diagram below illustrates the physical and logical connectivity for this scenario:

+---------------------+              +-------------------------------------+              +---------------------+
|   Internal Clients  |              |        Palo Alto Firewall           |              |     ISP Gateway     |
|   192.168.10.0/24   |              |         (VR-Default)                |              |    198.51.100.1     |
+----------+----------+              +------------------+------------------+              +----------+----------+
           |                                            |                                            |
           | ethernet1/2                                | ethernet1/1                                |
           | 192.168.10.1/24                            | 198.51.100.2/24                            |
           +--------------------------------------------+--------------------------------------------+
                     [ Trust Zone ]                                [ Untrust Zone ]

Example Addressing and Objects

The following example values represent our lab configuration. Production deployments must adapt these parameters to match actual network allocations.

Prerequisites

Before beginning the configuration steps, ensure the following prerequisites are met:

• Interfaces ethernet1/1 and ethernet1/2 are configured as Layer 3 interfaces with their respective IP addresses assigned.
• Security zones (Trust and Untrust) are created and attached to their respective interfaces.
• Administrative access to the PAN-OS Web Interface or CLI with full administrative privileges.

Step-by-Step GUI Configuration

Follow these steps to configure the Virtual Router, attach the physical interfaces, and create the default route in the Web Interface.

Step 1: Create or Modify the Virtual Router

In PAN-OS, firewalls include a default virtual router named default. You can modify the existing instance or create a custom Virtual Router object.

1. Log into the PAN-OS Web Interface.
2. Navigate to Network > Virtual Routers.
3. Click Add to create a new Virtual Router (or click default to edit the existing system instance).
4. In the Name field, enter VR-Default.
5. Under the Router- Interfaces section, click Add.
6. Select ethernet1/1 from the list.
7. Click Add again and select ethernet1/2.

Adding interfaces to the Virtual Router binds their Layer 3 connected subnets directly to this routing instance.

Step 2: Configure the Default Static Route

A default static route directs any traffic without a specific route match to the upstream ISP gateway.

1. In the Virtual Router configuration window, click the Static Routes tab.
2. Ensure the IPv4 sub-tab is selected, then click Add at the bottom of the window.
3. In the Name field, enter a descriptive route name such as Default-Route-ISP.
4. In the Destination field, enter 0.0.0.0/0.
5. In the Interface dropdown menu, select ethernet1/1.
6. In the Next Hop section, select the IP Address radio button.
7. In the text field next to IP Address, enter 198.51.100.1.
8. Leave Metric set to 10 and Admin Distance default (10 for static routes).
9. Click OK to close the Static Route window.
10. Click OK to save the Virtual Router settings.

Step 3: Commit Configuration Changes

PAN-OS uses a candidate configuration model. Changes take effect only after a successful commit operation.

1. Click Commit in the upper right corner of the Web Interface.
2. Click Commit in the pop-up dialog box to process candidate changes into the active configuration.
3. Wait for the commit process to reach 100% completion.

CLI Configuration

For administrators who prefer command-line execution, the following set commands perform the exact configuration demonstrated above.

Enter configuration mode from the CLI session:

configure

Assign interfaces ethernet1/1 and ethernet1/2 to the Virtual Router VR-Default:

set network virtual-router VR-Default interface [ ethernet1/1 ethernet1/2 ]

Configure the default static route targeting the ISP gateway:

set network virtual-router VR-Default routing-table ip static-route Default-Route-ISP destination 0.0.0.0/0 interface ethernet1/1 nexthop ip-address 198.51.100.1

Commit the candidate configuration to active operational memory:

commit

How the Traffic Flows

Understanding PAN-OS packet processing clarifies how the Virtual Router participates in forwarding decisions. Here is the step-by-step path a packet takes when traveling from the LAN to an internet address:

1. Ingress Packet Arrival: A client at 192.168.10.50 sends a packet destination IP 8.8.8.8. The packet enters interface ethernet1/2.
2. Interface & Zone Mapping: The firewall identifies that ethernet1/2 belongs to the Trust security zone and is bound to the Virtual Router VR-Default.
3. Routing Table Lookup (FIB Lookup): The firewall performs a destination IP lookup inside VR-Default‘s Forwarding Information Base (FIB).
   • Connected subnets (192.168.10.0/24 and 198.51.100.0/24) do not match 8.8.8.8.
   • The longest-prefix match process falls back to 0.0.0.0/0 (the default route).
4. Egress Interface & Zone Identification: The default route points to egress interface ethernet1/1. The firewall determines that ethernet1/1 belongs to the Untrust security zone.
5. Security Policy Evaluation: The firewall checks security policies for a matching rule allowing traffic from the Trust zone to the Untrust zone. If a match exists with an action set to allow, evaluation proceeds.
6. NAT Policy Evaluation: If a Network Address Translation rule exists, the source address 192.168.10.50 translates to public interface address 198.51.100.2.
7. Packet Egress: The firewall transmits the packet out interface ethernet1/1 directed to next-hop gateway 198.51.100.1 via Ethernet frame encapsulation.

Verification

Confirm the operational status of the Virtual Router and routing table using CLI operational commands.

1. Display the Active Routing Table (RIB)

Run the operational command to check active routes in the Routing Information Base:

show routing route

Example Output:

flags: A:active, ?:loose, C:connect, S:static, C:connect, B:bgp, O:ospf, R:rip

VIRTUAL ROUTER: VR-Default (id 1)
==========
destination          nexthop          metric flags age   interface
0.0.0.0/0            198.51.100.1     10     A S         ethernet1/1
192.168.10.0/24      192.168.10.1     0      A C         ethernet1/2
192.168.10.1/32      0.0.0.0          0      A C         ethernet1/2
198.51.100.0/24      198.51.100.2     0      A C         ethernet1/1
198.51.100.2/32      0.0.0.0          0      A C         ethernet1/1

The flag A S next to 0.0.0.0/0 verifies that the static route is active and loaded into the routing engine.

2. Test FIB Route Lookups

Simulate a forwarding engine route lookup for a specific destination host:

test routing fib-lookup virtual-router VR-Default ip 8.8.8.8

Example Output:

8.8.8.8 via 198.51.100.1 dev ethernet1/1 src 198.51.100.2 
    metric 10 host 8.8.8.8 interface ethernet1/1

This command proves that packets destination 8.8.8.8 hit the correct next-hop address and egress interface.

Troubleshooting

When route issues occur, systematically isolate potential root causes using this diagnostic breakdown.

Symptom 1: Default Route is Missing from Active Routing Table

• Likely Cause: The physical interface configured as the route’s egress path is in a down or link-down state. PAN-OS automatically removes static routes if their physical interface is unviable.
• Diagnostic Steps:

  Run the command to verify physical link operational status:

  show interface ethernet1/1

  Ensure link state reports up. Re-check physical cabling, media type speed/duplex settings, and connected switchports if down.

Symptom 2: Traffic Drops with “no-route” Reason in Traffic Logs

• Likely Cause: The ingress interface receiving local traffic is not bound to the Virtual Router containing the default route.
• Diagnostic Steps:

  Verify interface bindings on the Virtual Router:

  show network virtual-router VR-Default

  Ensure both internal and external Layer 3 interfaces appear in the interface assignment list.

Symptom 3: Route Exists but Internet Access Fails

• Likely Cause: Routing functions properly, but missing NAT policies or blocking Security policies stop outbound flow. Alternatively, return traffic from the ISP gateway is missing.
• Diagnostic Steps:

  Check the active session table to monitor real-time packet state:

  show session all filter source 192.168.10.50

  Look for state flags. If sessions show INIT or OUT_DISCARD, inspect security policy rules and outbound NAT rules.

Common Mistakes

• Omitting Interfaces from Virtual Router: Configuring static routes inside a Virtual Router without assigning participating interfaces prevents routing lookups from matching inbound interface traffic.
• Incorrect Next-Hop Subnetting: Assigning a static route next-hop IP that does not reside in the connected subnet of the egress interface. PAN-OS cannot resolve unattached next-hop IPs for static routes without secondary route recursions.
• Forgetting NAT Configuration: Assuming static routes allow internet connectivity without configured Source NAT. Public networks reject private RFC 1918 addresses (192.168.10.0/24).
• Uncommitted Candidate Changes: Adding routes in the GUI and closing the browser session without performing a successful system commit.

Production Considerations

When implementing Virtual Routers in high-availability enterprise networks, keep the following operational considerations in mind:

1. Path Monitoring Implementation

Static default routes depend on link state. If an upstream ISP provider loses connectivity upstream while the local ethernet link stays link-up, static routes remain active. Utilize Path Monitoring within static route settings to ping monitored upstream IP addresses (such as 8.8.8.8). If ICMP requests fail, PAN-OS automatically withdraws the static route, facilitating failover to a backup internet connection.

2. Multiple Virtual Routers vs. Single Virtual Router

Use multiple Virtual Routers when logical separation of network routing instances is required (such as isolating guest networks, tenant environments, or extranets). For simpler office deployments, maintaining a single Virtual Router minimizes routing complexity while simplifying operational management.

3. Administrative Distance and Metric Tuning

When dual ISP links are deployed, set differing Administrative Distances or Metrics to establish active/passive path preferences. The route with the lower Administrative Distance or Metric takes priority in the active forwarding table.

Summary

Configuring a Virtual Router and default route provides the core forwarding foundation for traffic moving across Palo Alto Networks firewalls. By binding interfaces to logical Virtual Routers and pointing default traffic (0.0.0.0/0) to an upstream ISP gateway, internal subnets gain reachability to external networks. Verify operational states using show routing route and test routing fib-lookup to ensure reliable, predictable network behavior.