topic Re: Prisma Access with ECMP in Prisma Access Discussions

Prisma Access with ECMP

Matt_Swinson — Thu, 11 Dec 2025 11:06:18 GMT

Hi Everyone,

We are trying to troubleshoot an issue where enabling ECMP on the Virtual Router breaks Prisma Access. We have 3 circuits configured (see pic) to load balance internet traffic. This firewall is also a service connection back to Prisma. When enabling the 3 link we loose routing from Prisma to the subnet advertised on the service coinnection. Removing the connection resolves the issue. We have raised multiple TAC cases with Palo who say everything looks ok on their side. Thanks for any suggestions.

Re: Prisma Access with ECMP

reaper — Thu, 11 Dec 2025 14:09:59 GMT

do you also have 3 SC tunnels or just the one?

if just the one, make sure that tunnel is not ECMP'd (sticky to 1 circuit)

is it set up using BGP or static routes?

sorry for the stupid questions, your picture wasnt attached 😉

Re: Prisma Access with ECMP

Matt_Swinson — Thu, 11 Dec 2025 15:19:56 GMT

Hi Tom, We have 3 SC tunnels (AMER, EMEA and APAC). This Firewall handles the EMEA traffic (Prisma). We have 3 circuits configured under ECMP (Picture attached 😞 ). The tunnel is configured to use the original circuit, using PBF. The tunnel is conifigured with static routes. Sorry this was configured by a previous Engineer, we only have issues when addining the new link.

Re: Prisma Access with ECMP

Matt_Swinson — Thu, 11 Dec 2025 15:21:08 GMT

Re: Prisma Access with ECMP

nikoolayy1 — Sun, 21 Dec 2025 09:16:29 GMT

Still the pictures are not seen @Matt_Swinson maybe attach a url link to the pictures as they could be in S3 Bucket or dropbox or OneDrive etc.