Basic Routing Concepts — Firewall Beginner's Guide

1 · Core Concepts

📦

What is Routing?

Routing is how a network device decides which interface to send a packet out of so it reaches its destination. Every packet has a destination IP — routing finds the path.

🗺️

The Routing Table

A list of known networks and "how to get there." The firewall checks this table for every packet, picking the most specific (longest) matching route.

🔗

Static Routes

Routes you manually enter. You tell the firewall: "to reach network X, send packets to next-hop Y." Simple and predictable — great for small networks.

🌐

Default Route

The catch-all route (0.0.0.0/0). If no other route matches, use this one. Usually points to your ISP — this is your path to the internet.

🏠

Next Hop

The IP address of the next device that should receive this packet. The firewall doesn't need to know the full path — just the next step.

Real-world analogy: Think of routing like a postal sorting office. Every package (packet) has a destination address. The sorters (firewall) check their address guide (routing table) and put each package on the right conveyor belt (interface). If the address is somewhere they've never heard of, they put it on the "everything else" belt (default route) heading to the main hub (ISP).

On a Palo Alto firewall: The routing table lives inside a Virtual Router. Go to Network → Virtual Routers → [your VR] → Static Routes to add routes manually. Unlike a traditional router, the Palo Alto also enforces Security Zones — so traffic between zones must match a Security Policy even if a route exists. A route alone isn't enough; you need both.

2 · Reading a Routing Table

Below is a typical routing table for a small branch firewall. The firewall checks entries from most specific (longest prefix) to least specific (shortest prefix). The highlighted row is the default route — the last resort for all unknown destinations.

Destination Network	Next Hop	Interface	Type	What it's for
192.168.1.0/24	— (directly connected)	ethernet1/1 (Trust)	Connected	The internal LAN — devices on your desk
10.10.10.0/30	— (directly connected)	ethernet1/2 (Untrust)	Connected	The link between firewall and ISP router
10.20.0.0/16	192.168.1.254	ethernet1/1 (Trust)	Static	Remote office network via internal router
0.0.0.0/0	10.10.10.1	ethernet1/2 (Untrust)	Default	Everything else → ISP router → Internet

3 · Packet Walkthrough Simulation

Follow a packet from a user's PC all the way to the internet. Click Next → to step through each stage.

Step 1 of 6

Step 1 — User sends a request

The user types google.com in their browser. After DNS resolves it to an IP like 142.250.80.46, the PC creates a packet with that destination address and sends it toward its default gateway — the Palo Alto firewall at 192.168.1.1.

4 · Knowledge Check

Question 1 of 5

correct answers