How to configure ECMP Equal Cost Multi-Path Between Palo Alto And Cisco

[ngeranio]

Is it Possible to achieve  ECMP between a cisco router and a PA-2000 series running PAN-OS 4.1.7

If Yes Can somebody point me to the right direction.

Thank You

[mikand]

I dont know if PA itself supports ECMP or not but usually (in my opinion) the ECMP will be setup in the routers before and after the PA-cluster (cluster of PA's who are individually configured (meaning no active/passive or active/active) in order to gain performance).

Most modern Cisco routers supports at least 8 paths of ECMP (meaning up to 8 nexthops with the same metric/cost and they all will be used).

What you must make sure is to use "ip load-sharing per-destination" (default when CEF is enabled) so that the traffic will use a single path for all src+dstip traffic (compared to ip "load-sharing per-packet" which would break things in this situation):

"

Configuring per-Destination Load Balancing

Per-destination load balancing is enabled by default when you enable CEF. To use per-destination load balancing, you do not perform any additional tasks once you enable CEF.

Per-destination load balancing allows the router to use multiple paths to achieve load sharing. Packets for a given source-destination host pair are guaranteed to take the same path, even if multiple paths are available. Traffic destined for different pairs tend to take different paths. Per-destination load balancing is enabled by default when you enable CEF, and is the load balancing method of choice for most situations.

Because per-destination load balancing depends on the statistical distribution of traffic, load sharing becomes more effective as the number of source-destination pairs increase.

You can use per-destination load balancing to ensure that packets for a given host pair arrive in order. All packets for a certain host pair are routed over the same link (or links).

"

[sdurga · Accepted solution]

Hi ,

Currently Paloalto does not do any kinds of ECMP routing. If we have two equal cost routes on the PAN, PAN will just use one of the two routes and will not do any load balancing. This is true for any protocol let it be static route or OSPF or anything. So if want to achieve ECMP you have to do it on either upstream/downstream of Paloalto.

Thanks,
Sandeep T

[junaid.khan]

Hi Sandeep,

May i know why ECMP is not supported ? What it takes to request it? I requested this back in 2011 and nothing happened since then. I would like to know, Why PA doesn't want to include ECMP ?

[pulukas]

Happy news, ECMP is added now in PanOS 7

ECMP