How to Implement ECMP (Load Balancing) on the Palo Alto Firewall

Overview

Equal Cost Multipath (ECMP) is a new feature introduced in PAN-OS 7.0. It provides multipath support for "equal cost" routes going to the same destination. There is a max of 4 equal cost paths supported

Without this feature, if there are multiple equal-cost routes to the same destination, the virtual router chooses one of those routes from the routing table and adds it to its forwarding table; it will not use any of the other routes unless there is an outage in the chosen route.

ECMP load balancing is done at the session level, not at the packet level—the start of a new session is when the firewall (ECMP) chooses an equal-cost path

This article focusses on basic configuration to achieve ECMP on the firewall

Details

Topology used for this article:

=======================

Interface configuration:

Note: ethernet1/1 and ethernet1/11 are ISP interfaces configured in different zones L3-Untrust and VPN respectively. However, these interfaces can be configured in same zone also

Route configuration with both default routes having "equal-cost":

NAT policy to be able to route traffic over internet:

Note: If both ISP interfaces are in the same zone, then destination interfaces need to be added to the NAT policy as in the following screenshot:

Security policy configuration to allow the traffic: (covers both scenario when interfaces are in same or different zone)

Enabling ECMP on the firewall:

Note:

- Max Path 2 means that only 2 equal cost paths will be installed in FIB table. If there are more than 2 equal-cost paths that need to be installed in FIB table, change Max Path value. Max supported value is 4.

- Load balance method can be selected according to the requirement. For more information about load balance algorithm, please click here

- Enable Symmetric Return if reply packet should be sent out the same interface that the request packet came in.

Verify ECMP is working:

Monitor > Traffic Logs (with different zone)

Monitor > Traffic Logs (with same zone)

Route installed for ECMP has a "E" flag in it: