Yes, the routers will do the loadsharing (decide which PA will get the traffic/session). A more fancy solution is to use a true loadbalancer such as F5 or so but since most routers supports ECMP and ECMP is enough for this case I see no reason to invest in two (well four for redundency) F5's for this matter. Compared to active-active config each PA will not know that there is another PA in the network. Another difference compared to active-active is that with active-active, even if both PA are active - only one "owns" the session which gives that the total throughput (or number of concurrent connections) is the same as with active/passive. On the other hand, this limit (active/active wont give you 2x performance - only 1x) is good when one box fails because you have the same throughput with only one still functional box. However... PA-5060 is rated for 10Gbit throughput (threat prevention) which means if you need lets say 40Gbit throughput PA currently doesnt have any option for that (as a single box). This is where an ECMP setup can be handy: 1) Setup ECMP in the routers before and after the PA array. 2) Connect 4x PA-5060 individually configured (no HA). 3) Done! 40Gbit in total throughput (but still max 10Gbit per session - same as when using ether/portchannel/lacp). There are other "loadsharing" methods one can apply in such situations (depending on how your network is setup) - one is to statically "loadshare" based on VLANs instead. Like VLAN 1-999 goes through PA-5060_1, VLAN 1000-1999 through PA-5060_2, 2000-2999 through PA_5060_3 and 3000-4096 through PA-5060_4 (or which VLAN id is the highest that PA supports). The drawback here will instead be if you have for example your fileserver and mailservers at VLAN 101 and 102 which might be like 90% of your total utilization this traffic will slam into PA_5060_1 while the other three boxes will basically just idle (compared to an ECMP setup where all four would work). The good thing on the other hand is that you wont get a decrease in bandwidth if one box fails (well given the PA-5060_x is actually two boxes running in active/passive). Regarding failover condition ECMP will react if the interface goes down and then push that traffic over one of the other paths (in this case it depends on how you have setup your PA regarding tcp-reject-non-syn if the moved sessions will fail or continue to function) - otherwise you can use IP-SLA (or similar) to withdraw the route if, for example, a ping doesnt reach to the other side of the PA for a particular path. For example a setup like: Outer-Router: int0/1: VLAN101 10.0.101.2/30 int0/2: VLAN102 10.0.102.2/30 ip route x.x.x.x/x next 10.0.101.1 track 1 ip route x.x.x.x/x next 10.0.102.1 track 2 PA-boxes int1: VLAN10x 10.0.10x.1/30 int2: VLAN20x 10.0.20x.2/30 Inner-Router: int0/1: VLAN201 10.0.201.1/30 int0/2: VLAN202 10.0.202.1/30 ip route 0.0.0.0/0 next 10.0.201.2 track 1 ip route 0.0.0.0/0 next 10.0.202.2 track 2 The IP-SLA config could be something like (example for Inner-Router): ip sla 1 icmp-echo 10.0.101.2 source-interface int0/1 timeout 1000 threshold 2 frequency 3 ip sla schedule 1 life forever start-time now track 1 ip sla 1 reachability ip sla 2 icmp-echo 10.0.102.2 source-interface int0/2 timeout 1000 threshold 2 frequency 3 ip sla schedule 2 life forever start-time now track 2 ip sla 2 reachability This way Inner-Router will use each physical interface to ping the equal interface at Outer-Router and by that be able to detect if the PA in this particular path is functional or not (and if not then remove the route connected to this particular ip-sla through track). For more information on IP-SLA: http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/813-cisco-router-ipsla-basic.html What I havent verified yet is if track will enable ECMP or not (if both track 1 and 2 are successful, will both routes have the same metric and therefor have ECMP enabled?).
... View more
