high CPU (management plane) after enabling ECMP

[JoergSchuetter]

Hello

We have an active/passive cluster (PA-820) which we use for IPSec tunnels (with 30 different partners).

One of the partners insisted on having a redundant connection using two IPSec tunnels with different peers. So we came up with the idea of enabling ECMP. Based on the routing table, this looks fine (same destination network listed twice, marked with an "e" in the list).

Unfortunately the CPU of the management plane went up (from ~30% to ~99%) after ECMP was enabled. Event the management plane on the passive node is at ~70%.

PAN-OS: 9.1.7

Is this a common behaviour of using ECMP (on tunnel interfaces)?

[BPry · Accepted solution]

@JoergSchuetter,

I've never enabled ECMP on such a small platform, but it's not uncommon to see a rise in management utilization after its enabled. Can I ask why you enabled ECMP for this scenario however? I don't see how it really gains you anything in the situation that you've described. You could have utilized tunnel monitoring or static route path monitoring and wouldn't have needed to touch ECMP. 

[JoergSchuetter]

@BPry 

Thanks for the hint regarding tunnel monitoring vs. ECMP. We picked the latter since it sounds very simply (enable the feature, no need to setup monitors per tunnel, ...).