Asymmetric routing remote networks: after migration from service connections.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Asymmetric routing remote networks: after migration from service connections.

L3 Networker

Hello,

 

We are in the progress of migration an existing service connection on an Active/Active firewall to a remote network connection.
The active/active firewall doesn't have VR-SYNC enabled so they act as seperate routing instances, and the subnets attached use a mixture of ARP-loadsharing and FLOATING IP's. (sometimes active on Pri, sometimes active on Secondary).  Currently we have service connection to MX-Central and US-Central.

Last time we tried to migrate we setup 2 remote network connections in different locations MX-Central and US-Central.  However we noticed that some traffic was dropped due to assymatric routing on the prisma cloud remote networks.   (this doesn't happen for service connections because of router-id)

Can I solve this with creating 2 remote network connections in the same compute location?

 

 

 

 

1 REPLY 1

L6 Presenter

Have you tried enabling "asymetric-routing-only. to allow Prisma Access to use asymmetric flows across the service connection backbone" https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-pris... ?

 

Outside of that you can try adding a zone protection profile to the zones for Prisma Access https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSHCA0 / https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClG2CAK but I have not tested that one and I im interested if you tested your suggestion.

  • 1539 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!