topic Re: high CPU (management plane) after enabling ECMP in General Topics

high CPU (management plane) after enabling ECMP

JoergSchuetter — Mon, 29 Nov 2021 16:34:31 GMT

Hello

We have an active/passive cluster (PA-820) which we use for IPSec tunnels (with 30 different partners).

One of the partners insisted on having a redundant connection using two IPSec tunnels with different peers. So we came up with the idea of enabling ECMP. Based on the routing table, this looks fine (same destination network listed twice, marked with an "e" in the list).

Unfortunately the CPU of the management plane went up (from ~30% to ~99%) after ECMP was enabled. Event the management plane on the passive node is at ~70%.

PAN-OS: 9.1.7

Is this a common behaviour of using ECMP (on tunnel interfaces)?

Re: high CPU (management plane) after enabling ECMP

BPry — Tue, 30 Nov 2021 02:32:29 GMT

@JoergSchuetter,

I've never enabled ECMP on such a small platform, but it's not uncommon to see a rise in management utilization after its enabled. Can I ask why you enabled ECMP for this scenario however? I don't see how it really gains you anything in the situation that you've described. You could have utilized tunnel monitoring or static route path monitoring and wouldn't have needed to touch ECMP.

Re: high CPU (management plane) after enabling ECMP

JoergSchuetter — Mon, 06 Dec 2021 08:46:05 GMT

@BPry

Thanks for the hint regarding tunnel monitoring vs. ECMP. We picked the latter since it sounds very simply (enable the feature, no need to setup monitors per tunnel, ...).