topic Re: ECMP Strict Source Path in General Topics

ECMP Strict Source Path

santonic — Mon, 11 Feb 2019 07:31:52 GMT

Hello.

In ECMP settings there is Strict Source Path option to enable. But I can't find any descriptin about this option anywhere. Anyone knows what exactly does this option do?

Re: ECMP Strict Source Path

gwesson — Tue, 12 Feb 2019 13:53:15 GMT

This has been bugging me since it was posted. I was finally able to do enough digging and found the answer.

Strict Source Path is a feature of the ECMP specification, rather than a feature unique to Palo Alto Networks. There are 2 types of source routing with ECMP, loose and strict.

Check the following RFC, section 3.1. The subsections are titled "Loose Source and Record Route" and "Strict Source and Record Route".

https://tools.ietf.org/rfc/rfc791.txt

Both require options in the IP header. Loose (type=131) is by far the most common, but some environments will need strict (type=137).

Re: ECMP Strict Source Path

Abdul_Razaq — Tue, 12 Feb 2019 14:09:24 GMT

Hi @gwesson,

Thanks, i also had this query.

It may be not relevent here, but appreciate if you can clarify me in this option, I can see 'symmetric return' under ECMP option, is this a alternative option for symmetric return in dual ISP failover/ECMP scenario ?. i have seen in dual ISP scenarios, poeple were using PBF for symmetric return enforcement.

So if i have web services running inside and ECMP is enabled in dual ISP scenario, i just need to enable this option instead of doing PBF and select ' symmetric return' ?

Re: ECMP Strict Source Path

gwesson — Tue, 12 Feb 2019 14:19:13 GMT

@Abdul_Razaq they're related, but do different things in their own context. The PBF option is when you could have asymmetric routes, whereas in ECMP it overrides the inherent load balancing that ECMP provides. Both of the following are pulled from the inline help on the firewall from their respective sections:

Symmetric return in ECMP

Select Symmetric Return to cause return packets to egress out the same interface on which the associated ingress packets arrived. That is, the firewall will use the ingress interface on which to send return packets, rather than use the ECMP interface, so the Symmetric Return setting overrides load balancing. This behavior occurs only for traffic flows from the server to the client.

Symmetric return in PBF

Select Enforce Symmetric Return and enter one or more IP addresses in the Next Hop Address List. Enabling symmetric return ensures that return traffic (such as from the Trust zone on the LAN to the Internet) is forwarded out through the same interface through which traffic ingresses from the internet.

Re: ECMP Strict Source Path

santonic — Fri, 15 Feb 2019 07:03:17 GMT

Ty for the info.

Re: ECMP Strict Source Path

jchen1 — Thu, 08 Aug 2019 22:46:22 GMT

"strict source path" means no ECMP. It applies to firewall originated IKE/IPsec traffic. Traffic will be sent out over the tunnel based on which tunnel the source address belong to. It has nothing to do with real "source routing". It does not affect transit traffic. Similar to "symetric return" it is an exception of ECMP hashing.

Re: ECMP Strict Source Path

Stevenjwilliams83 — Fri, 22 Nov 2019 03:53:11 GMT

Strict Source Path - I still to this day have no idea what this option is for, what it does or doesn't do, and when to and not to use it. Not a lot of documentation on it from Palo themselves.

Re: ECMP Strict Source Path

junior_r — Sun, 15 Dec 2019 18:50:07 GMT

are we sure this is correct?

I see different behavior . Where traffic is from source is still doing route lookup to send traffic out.

Thanks

Re: ECMP Strict Source Path

jchen1 — Mon, 16 Dec 2019 17:50:32 GMT

There seems some rework after my last comments. However, the behavior should not changed. Have you checked the new release notes?

Re: ECMP Strict Source Path

tburdettek2 — Wed, 07 Feb 2024 19:30:08 GMT

For everyone potentially still looking and wondering, I found this in Palo 10.1 documentation:

Strict Source Path	By default, IKE and IPSec traffic originating at the firewall egresses an interface that the ECMP load-balancing method determines. Select Strict Source Path to ensure that IKE and IPSec traffic originating at the firewall always egresses the physical interface to which the source IP address of the IPSec tunnel belongs. Enable Strict Source Path when the firewall has more than one ISP providing equal-cost paths to the same destination. The ISPs typically perform a Reverse Path Forwarding (RPF) check (or a different check to prevent IP address spoofing) to confirm that the traffic is egressing the same interface on which it arrived. Because ECMP by default chooses an egress interface based on the configured ECMP method (instead of choosing the source interface as the egress interface), that will not be what the ISP expects and the ISP can block legitimate return traffic. In this use case, enable Strict Source Path so that the firewall uses the egress interface that is the interface to which the source IP address of the IPSec tunnel belongs.