Asymmetric routing remote networks: after migration from service connections.

[zGomez]

Hello,

We are in the progress of migration an existing service connection on an Active/Active firewall to a remote network connection.
The active/active firewall doesn't have VR-SYNC enabled so they act as seperate routing instances, and the subnets attached use a mixture of ARP-loadsharing and FLOATING IP's. (sometimes active on Pri, sometimes active on Secondary).  Currently we have service connection to MX-Central and US-Central.

Last time we tried to migrate we setup 2 remote network connections in different locations MX-Central and US-Central.  However we noticed that some traffic was dropped due to assymatric routing on the prisma cloud remote networks.   (this doesn't happen for service connections because of router-id)

Can I solve this with creating 2 remote network connections in the same compute location?

[nikoolayy1]

Have you tried enabling "asymetric-routing-only. to allow Prisma Access to use asymmetric flows across the service connection backbone" https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-pris... ?

Outside of that you can try adding a zone protection profile to the zones for Prisma Access https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSHCA0 / https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClG2CAK but I have not tested that one and I im interested if you tested your suggestion.