Active/Active ECMP

[Stevenjwilliams83]

I have two Palo Alto 5250s running in my core network as a core firewall for all campus and datacetner traffic. They are running active/active. I have layer 3 routing south bound to two cat9500s not in VSS. So I am running HSRP on each 9500 alternating vlans to utilize them both. All 4 units are running OSPF to advertise loopbacks and iBGP is used to carry routes. The 9500s are setup for ECMP and so are the Palo Altos. I feel like there is some weird traffic issues with this, Should the Palo Altos even be setup with ECMP? If so should I be using the symetrical return option? Would having ECMP on the Cat9500s be enough to achieve load sharing/balancing over each layer 3 link to each Palo Alto? Each cat 9500 has a layer 3 link to each Palo Alto. And yes before people tell me Active/Active is not a good idea I cant see why not when my network is symetrical. 

[jeremy.larsen]

ECMP should still work as long as you remove HSRP regardless of router ID for "Equal Cost Paths" only.

[Stevenjwilliams83]

Not running active/active for increase performance because I know you get maybe 20% on that. I am using it because I have two active core switches and it becomes a load share game. Do ditch HSRP and use what for LAN side? thats the real challenge. 

[jeremy.larsen]

MC-LAG?  Not sure the new 9500s support that.  Are you avoiding stacking them for any specific reason?

[Stevenjwilliams83]

Cat9500s not stacked, no VSS, no Nexus core running active/active HSRP. So doesnt qualify. 

[Stevenjwilliams83]

Now, I am fantasizing here, but I thought about running HSRP egress side to the palos and running palos with floating IP (essentially vrrp)....

[jeremy.larsen]

Be aware, there are some pretty specific restrictions/caveats with floating IPs especially when it comes to NAT.  If you don't have asynchronous routing and you aren't utilizing ECMP, Active/Passive is the way to go.

[Stevenjwilliams83]

Avoid the stacking because in-service upgrades give me PTSD. No NAT because they are Core Firewalls. Would like to use ECMP but it seems to be a headache. And even with Active/Passive and HSRP there is still the issue that there is a 50 percent chance that the active firewall will send the return traffic to the standby HSRP node. 

[BPry]

@Stevenjwilliams83,

I'm lost on why you think you are going to hit the standby HSRP node? HSRP is going to give you an address that you can target as your next-hop address for routing. If you want to use HSRP, then you remove ECMP. If you want to use ECMP, then you remove HSRP. 

[jeremy.larsen]

Yes, yes, and double yes.

Or you could stack your switches downstream from the 9500s and push Layer 3 out toward the access layer.  Then you would pretty much be using them as routers and you can ECMP all day long.

[Stevenjwilliams83]

How do you figure? If each palo is learning each HSRP group VLAN via a routing protocol and both core switches own an SVI for that vlan, network is now connected. So OSPF will see the same subnet for a single vlan on each core switch as connected and based on ecmp will have a 50/50 shot of sending it the right node.