Asymmetric routing remote networks: after migration from service connections.

zGomez — Mon, 20 Mar 2023 14:10:57 GMT

Hello,

We are in the progress of migration an existing service connection on an Active/Active firewall to a remote network connection.
The active/active firewall doesn't have VR-SYNC enabled so they act as seperate routing instances, and the subnets attached use a mixture of ARP-loadsharing and FLOATING IP's. (sometimes active on Pri, sometimes active on Secondary). Currently we have service connection to MX-Central and US-Central.

Last time we tried to migrate we setup 2 remote network connections in different locations MX-Central and US-Central. However we noticed that some traffic was dropped due to assymatric routing on the prisma cloud remote networks. (this doesn't happen for service connections because of router-id)

Can I solve this with creating 2 remote network connections in the same compute location?

Re: Asymmetric routing remote networks: after migration from service connections.

nikoolayy1 — Wed, 22 Mar 2023 09:41:50 GMT

Have you tried enabling "asymetric-routing-only. to allow Prisma Access to use asymmetric flows across the service connection backbone" https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-prisma-access-infrastructure/prisma-access-service-infrastructure/enable-the-service-infrastructure ?

Outside of that you can try adding a zone protection profile to the zones for Prisma Access https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSHCA0 / https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClG2CAK but I have not tested that one and I im interested if you tested your suggestion.

topic Re: Asymmetric routing remote networks: after migration from service connections. in Prisma Access Discussions

Asymmetric routing remote networks: after migration from service connections.

Re: Asymmetric routing remote networks: after migration from service connections.