I have two Palo Alto 5250s running in my core network as a core firewall for all campus and datacetner traffic. They are running active/active. I have layer 3 routing south bound to two cat9500s not in VSS. So I am running HSRP on each 9500 alternating vlans to utilize them both. All 4 units are running OSPF to advertise loopbacks and iBGP is used to carry routes. The 9500s are setup for ECMP and so are the Palo Altos. I feel like there is some weird traffic issues with this, Should the Palo Altos even be setup with ECMP? If so should I be using the symetrical return option? Would having ECMP on the Cat9500s be enough to achieve load sharing/balancing over each layer 3 link to each Palo Alto? Each cat 9500 has a layer 3 link to each Palo Alto. And yes before people tell me Active/Active is not a good idea I cant see why not when my network is symetrical.
hould the Palo Altos even be setup with ECMP?
Depends on how many uplinks you have between the Palo Alto and the 9500s, and if the answer is more than one are you not utilizing simple AE interfaces? It sounds like you have two 9500s and each 9500 has a link to each active peer correct? If that's the case you could actually be introducing asymetrical return traffic depending on your configuration.
If so should I be using the symetrical return option?
We'd need to know more about how your firewall is actually configured to give a yay or nay on this. From the rough outline that can be gathered from your post it sounds as though enforcing symetrical return traffic would be a good idea; but we would need more info about the actual config to be positive.
Would having ECMP on the Cat9500s be enough to achieve load sharing/balancing over each layer 3 link to each Palo Alto?
I assume that you are talking about removing the ECMP configuration on the firewall? It would achieve a level of load balancing from your cores, but depending on the rest of your configuration this could cause issues.
And yes before people tell me Active/Active is not a good idea I cant see why not when my network is symetrical.
With emphisis on the fact that you state your network is symetrical, this would actually be an instance where we would 100% not generally recommend someone utilize Active/Active outside of a handful of other factors. Active/Active is best deployed in a network where you have asymetrical traffic
Yes Each 9500 has a link to each Palo Alto so "criss-crossed" essentially. No ae interfaces being used just straight /30 routed links between 9500s and Palo Altos. So if I have vlan 10, 20, 30, and 40, 9500-01 has hsrp active for vlan 10,30 and 9500-02 has hsrp active for vlan 20,40 to use both swtiches rather then one sit idle.
I to this day do not understand why you want active and active in an asymetrical network rather then symetrical? Also wouldnt you want to ultilize BOTH firewalls when you can?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!