Additional ECMP Settings
Table of Contents
Additional ECMP Settings
316 PIC
After you complete the basic configurations
of ECMP, there are a few additional ECMP-related settings. Follow
the sections to learn about each.
ECMP Region Location Detection
ECMP automatically detects the closest Prisma Access location for a branch to connect. The
closest location is determined by the values of Latitude/Longitude entered in the
site details for a branch.
The CloudBlade API determines the country, and
the local language support for the branch via the location. Wherever
possible, it will connect that branch to the appropriate Prisma
Access region with the language support for the country that the branch
is in.
The region needs to be changed manually to a desired region, as shown below.
Auto-detect
only works with Non-Aggregate Bandwidth model. If using the Aggregate
Bandwidth model, you must assign interface-level tags appropriately
to add them to an ECMP deployment for Prisma Access.
ECMP Bandwidth Detection
ECMP uses the circuit bandwidth to automatically set the Prisma Access bandwidth. To override
this behavior, adjust the bandwidth for ECMP accordingly.
This capability is supported only in non-aggregate bandwidth model. For aggregate bandwidth
model, it is recommended to set this value to Auto
Detect.
ECMP Configuration for a Single Link
On having two or more connections to a branch, the Prisma SD-WAN ION device can pre-configure
ECMP with only a single link to a device. When configuring ECMP on a single link,
the following restrictions will apply.
- The link will appear as a non-ECMP link in Prisma Access.
- When a second link is configured or enabled for Prisma Access, the site will automatically enable ECMP with symmetric return in Prisma Access.
ECMP Circuit Usage and Exemption
By default,
ECMP will build a Standard VPN to Prisma Access on up to four interfaces
which are able to reach Prisma Access. This can include, but is
not limited to Internet circuits (Cable, DSL, 3G/4G/5G/LTE) and
Private WAN Circuits (MPLS).
ECMP does NOT look at the
circuit category to bring up a path to Prisma Access. Rather, it
looks at whether or not the circuit for a device has reachability
to Prisma Access in order to add to the ECMP bundle.
There
can be situations where certain circuit categories at a global level
or circuits at a device level should be excluded or allowed to participate
in ECMP. For example, Private WAN paths may not be required at an
organization to become part of an ECMP bundle.
To accomplish
this, the following tag can be applied globally or at the device level: prisma_ecmp_exclude
Application
of the tag at the Device Interface or Global level will prevent
ECMP from using that category or port for inclusion.
This
capability is supported only in Non-Aggregate Bandwidth model.
ECMP Branches with High-Availability
The CloudBlade also supports High-Availability designs, while allowing for licenses
to be consumed by the Primary/Active Prisma SD-WAN ION device, while the backup
Prisma SD-WAN ION device does not consume a license to Prisma Access.
To enable ECMP HA licensing, under the PRIMARY/ACTIVE Prisma SD-WAN ION device,
enable the following prisma_ha_primary tag as shown.
This signals to the CloudBlade to replicate the Standard VPN tunnels to Prisma Access
to the backup/secondary unit. In the event of a changeover to the secondary Prisma
SD-WAN ION device, the tunnels are already configured, but do not consume
licensing.
The CloudBlade does not support the building of tunnels from
a site that has two (or more) standalone ION devices, which are not in a HA
configuration.
ECMP Site-Level Interface Tags
As auto region selection, 3.1.6 tags are
not interoperable, for each link under the ECMP bundle/region. The local interface
tags must also be applied as described in the previous
section.
prisma_region:us-east-1:us-east-charlockprisma_region:us-east-1:us-east-banyan
OR
prisma_region:us-east-1:1prisma_region:us-east-1:2In order to assist
with the automation of the scripts and deployments, the Prisma SD-WAN Tagger script can also be used to help create or configure the
tags.