ECMP Single Interface

dustin.campbell — Mon, 20 Nov 2023 16:01:34 GMT

I have an HA pair of firewalls in my data center. I have a single ISP that provides two routers for internet access. I use HSRP on those routers, which obviously share the same subnet on the inside interface that connects to the outside interface of the Palo Alto firewalls. I have two instances of HSRP setup to where some of my other perimeter devices can use ISP router A and the Palo Alto can use ISP router B. I'd like to get the Palo Alto to use both router A and B though. Can I add an additional default route to the virtual router that uses the other router's HSRP IP and then enable ECMP? I would have two default routes on the same virtual router; one going to router A's HSRP IP and one going to router B's HSRP IP.

I can't seem to find any examples of using ECMP via a single interface. All examples are when you have two separate interfaces that you want to route out of. Would this setup work?

Re: ECMP Single Interface

TomYoung — Tue, 21 Nov 2023 00:51:58 GMT

Hi @dustin.campbell ,

I don't see why it wouldn't work. ECMP will allow for multiple routes to the same destination. I doubt it does an interface check except to verify it is a L3 interface. Follow the dual-interface example, but point your 2 routes to the same interface.

Check your routing table (Network > Virtual Routers > More Runtime Stats) to verify both routes are present. You could even configure path monitoring for your static routes for automatic failover. https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/static-routes/configure-path-monitoring-for-a-static-route

Thanks,

Tom

topic Re: ECMP Single Interface in General Topics

ECMP Single Interface

Re: ECMP Single Interface