Prisma Access with ECMP

[Matt_Swinson]

Hi Everyone,

We are trying to troubleshoot an issue where enabling ECMP on the Virtual Router breaks Prisma Access. We have 3 circuits configured (see pic) to load balance internet traffic. This firewall is also a service connection back to Prisma. When enabling the 3 link we loose routing from Prisma to the subnet advertised on the service coinnection. Removing the connection resolves the issue. We have raised multiple TAC cases with Palo who say everything looks ok on their side. Thanks for any suggestions.

[reaper]

do you also have 3 SC tunnels or just the one? 

if just the one, make sure that tunnel is not ECMP'd (sticky to 1 circuit)

is it set up using BGP or static routes?

sorry for the stupid questions, your picture wasnt attached 😉

[Matt_Swinson]

Hi Tom, We have 3 SC tunnels (AMER, EMEA and APAC). This Firewall handles the EMEA traffic (Prisma). We have 3 circuits configured under ECMP (Picture attached 😞 ). The tunnel is configured to use the original circuit, using PBF. The tunnel is conifigured with static routes. Sorry this was configured by a previous Engineer, we only have issues when addining the new link.