Onboard an ECMP Site

Onboard an ECMP Site

1. In Prisma SD-WAN, go to WorkflowsPrisma SD-WAN SetupBranch Sites, and select a site.

   

2. Click the extended tags icon on the Edit Site screen to view ECMP.

   

   When you create an ECMP bundle, the default selection is Auto Detect for both Region and License level sections by default.
   With Aggregate Bandwidth licensing mode, the auto region detection for ECMP bundles isn't recommended to be used. There is no current logic today from the CloudBlade and Prisma integration to determine if a region has bandwidth allocated (and IPSec Termination Nodes behind it). The current CloudBlade logic assumes that all regions have bandwidth available.

   

Additional ECMP Settings

After you complete the basic configurations of ECMP, there are a few additional ECMP-related settings. Follow the sections to learn about each.

ECMP Region Location Detection

ECMP automatically detects the closest Prisma Access location for a branch to connect based on the Latitude and Longitude values entered in the Site Details for a branch.

The CloudBlade API determines the country, and the local language support for the branch via the location. Wherever possible, it will connect that branch to the appropriate Prisma Access region with the language support for the country that the branch is in.

With the Prisma Access aggregate bandwidth licensing, the region needs to be changed manually to a desired region, as shown below.

Auto-detect only works with Prisma Access non-aggregate bandwidth model. If using the Prisma Access aggregate bandwidth model, you must assign interface-level tags appropriately to add them to an ECMP deployment for Prisma Access.

ECMP Bandwidth Detection

ECMP uses the circuit bandwidth to automatically set the Prisma Access bandwidth. To override this behavior, adjust the bandwidth for ECMP accordingly.

This capability is supported only in non-aggregate bandwidth model. For the aggregate bandwidth model, it's recommended to set this value to Auto Detect.

ECMP Configuration for a Single Link

Some organizations that plan on having two or more connections to a branch Prisma SD-WAN ION device can pre-configure ECMP with only a single link to a device. When configuring ECMP on a single link, the following notes and restrictions will apply.

• The link will appear as a non-ECMP link in Prisma Access.
• When a second link is configured and enabled for Prisma Access, the site will automatically enable ECMP with symmetric return in Prisma Access.

ECMP Circuit Usage and Exemption

In the Cloud Managed Cloudblade, by default, ECMP will build a Standard VPN to Prisma Access on up to four interfaces, which are able to reach Prisma Access. This can include, but isn't limited to internet circuits (Cable, DSL, 3G/4G/5G/LTE) and Private WAN Circuits (MPLS).

ECMP does NOT look at the circuit category to bring up a path to Prisma Access. Rather, it looks at whether or not the circuit for a device has reachability to Prisma Access to add to the ECMP bundle.

There can be situations where certain circuit categories at a global level or circuits at a device level should be excluded or allowed to participate in ECMP. For example, Private WAN paths may not be required at an organization to become part of an ECMP bundle.

To accomplish this, the following tag can be applied globally or at the device level: prisma_ecmp_exclude

Application of the tag at the Device Interface or Global level will prevent ECMP from using that category or port for inclusion.

This capability is supported only in the non-aggregate Bandwidth model.

ECMP Branches with High-Availability

The CloudBlade also supports high availability designs, while allowing for licenses to be consumed by the Primary or Active Prisma SD-WAN ION device, while the backup Prisma SD-WAN ION device does not consume a license to Prisma Access.

To enable ECMP HA licensing, under the PRIMARY/ACTIVE Prisma SD-WAN ION device, enable the following prisma_ha_primary tag as shown.

This signals to the CloudBlade to replicate the Standard VPN tunnels to Prisma Access to the backup/secondary unit. In the event of a changeover to the secondary Prisma SD-WAN ION device, the tunnels are already configured, but don't consume licensing.

ECMP Site-Level Interface Tags

As auto region selection, tags are not interoperable for each link under the ECMP bundle or region. The local interface tags must also be applied as described in the previous section.

prisma_region:us-east-1:us-east-charlockprisma_region:us-east-1:us-east-banyan OR prisma_region:us-east-1:1prisma_region:us-east-1:2

To assist with the automation of the scripts and deployment, the Prisma SD-WAN Tagger Utility Script can be used to help create and configure the tags.