Static Route Fails: Next Hop in Different Virtual Router
An administrator configures a firewall with two virtual routers: VR1 and VR2. VR1 connects to the corporate network and VR2 to an ISP. The administrator creates a static route in VR1 to reach the internet via a next hop of 10.0.0.1, but traffic from VR1 to the internet fails. What is the most likely cause?
Quick Answer
The answer is that the static route fails because the next hop 10.0.0.1 resides in a different virtual router, VR2, and VR1 has no direct path to it. Virtual routers on Palo Alto firewalls operate as completely isolated routing tables, meaning traffic in VR1 cannot automatically reach a next hop that exists only in VR2’s routing table unless route leaking or redistribution is explicitly configured. Since the static route points to an unreachable next hop from VR1’s perspective, the route is not installed in the forwarding table, causing the failure. On the PCNSE exam, this scenario tests your understanding of virtual router isolation and static route installation rules—a common trap is assuming that simply specifying an IP address will work across VRs. Remember the memory tip: “A route is only as good as its next hop’s reachability; if the next hop lives in another VR, you need a bridge to get there.”
⚠ Common exam trap
A common mix-up: candidates assume virtual routers are interconnected by default, similar to VLANs, but in Palo Alto firewalls they are fully isolated routing instances that require explicit route sharing to pass traffic between them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The static route in VR1 does not point to an interface or next hop that is reachable via VR2.
Virtual routers in Palo Alto Networks firewalls are isolated routing tables; traffic in VR1 cannot reach VR2 unless there is a route leaking or redistribution policy configured. The static route in VR1 points to 10.0.0.1, which is a next-hop IP that exists only in VR2’s routing table (the ISP-facing side). Since VR1 has no direct path or inter-virtual-router connection to reach that next hop, the route is considered unreachable and will not be installed in the forwarding table, causing the failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The static route in VR1 does not point to an interface or next hop that is reachable via VR2.
Why this is correct
Without route redistribution, VR1 cannot use VR2's routes.
- ✗
The firewall does not support multiple virtual routers.
Why it's wrong here
Palo Alto firewalls do support multiple virtual routers.
- ✗
The virtual routers are not connected to each other.
Why it's wrong here
They can be connected via a shared interface or redistribution.
- ✗
NAT is not configured on VR2.
Why it's wrong here
NAT is not required for routing; it is for address translation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An administrator is troubleshooting traffic from a host at 10.2.2.10 to a server at 10.3.3.10. The firewall has a security rule allowing the traffic. However, traffic is failing. Based on the routing table, what is the most likely cause?
medium- ✓ A.The next hop 10.1.1.200 for the destination 10.3.3.0/24 is unreachable.
- B.The destination network 10.3.3.0/24 is not in the routing table.
- C.The source network 10.2.2.0/24 is not in the routing table.
- D.The default route 0.0.0.0/0 is missing.
Why A: The routing table shows a route to 10.3.3.0/24 with next hop 10.1.1.200. If that next hop is unreachable (e.g., due to an ARP failure, interface down, or no route to the next hop itself), the firewall cannot forward the packet to the destination, even though a security rule permits the traffic. This is the most likely cause of the failure because the route exists but the next hop is not reachable.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.