Configure Virtual Routers (Strata Cloud Manager)

1. Log in to Strata Cloud Manager.
2. Select ConfigurationNGFW and Prisma Access and select the Configuration Scope where you want to create the virtual router.
3. Select Network & DeviceRoutingVirtual Routers tab.

   On new Strata™ Cloud Manager tenants, the Routing page displays both Logical Routers and Virtual Routers tabs; existing Strata™ Cloud Manager tenants see only the Virtual Routers tab.

   You can select a folder or firewall from your Folders, or select Snippets to configure the virtual router in a snippet.

   Virtual router configurations apply only to firewalls configured to use the legacy routing engine. You set the routing mode at the device level. Firewalls using the Advanced Routing Engine use logical router configurations instead.

4. Click Add Virtual Routers.

5. Enter a descriptive Name.
6. Enable Equal Cost Multiple Path (ECMP) for a virtual router.

   • Specify the maximum number of equal-cost paths (to a destination network) that can be copied from the Routing Information Base (RIB) to the Forwarding Information Base (FIB). For ECMP Max Path, enter 2, 3, or 4. Default is 2.
   • Enable symmetric return of packets from server to client. Select Symmetric Return to cause return packets to egress out the same interface on which the associated ingress packets arrived. That is, the firewall will use the ingress interface on which to send return packets, rather than use the ECMP interface. The Symmetric Return setting overrides load balancing. This behavior occurs only for traffic flows from the server to the client.
   • Enable Strict Source Path to ensure that IKE and IPSec traffic originating at the firewall egresses the physical interface to which the source IP address of the IPSec tunnel belongs.When you enable ECMP, IKE and IPSec traffic originating at the firewall by default egresses an interface that an ECMP load-balancing method determines. Alternatively, you can ensure that IKE and IPSec traffic originating at the firewall always egresses the physical interface to which the source IP address of the IPSec tunnel belongs, by enabling Strict Source Path. You would enable this function when the firewall has more than one ISP providing equal-cost paths to the same destination. ISPs typically perform a reverse Path Forwarding (RPF) check (or a different check to prevent IP address spoofing) to confirm that traffic is egressing the same interface on which it arrived. Because ECMP would choose an egress interface based on the configured ECMP method (instead of choosing the source interface as the egress interface), that wouldn’t be what the ISP expects and the ISP could block legitimate return traffic. In this case, enable Strict Source Path so that the firewall uses the egress interface that is the interface to which the source IP address of the IPSec tunnel belongs, the RPF check succeeds, and the ISP allows the return traffic.
   • Specify the load-balance Action for the virtual router.
     • Balanced Round Robin—Uses round-robin among the ECMP paths and rebalances paths when the number of paths changes.
     • IP Hash—Use a hash of the source and destination IP addresses to determine which ECMP route to use. If you select this option, can select to Use Source Address Only and Use Source/ Destination port for hash.
     • IP Modulo—Uses a hash of the source and destination IP addresses in the packet header to determine which ECMP route to use.
     • Weighted Round Robin—Uses round-robin and a relative weight to select from among ECMP paths.
7. Add an Interface.

   Repeat this step to add as many Layer 3, loopback, and tunnel interfaces as needed.
8. Add an Interface.

   Repeat this step to add as many Layer 3, loopback, VLAN, and tunnel interfaces as needed. Each interface can belong to only one virtual router.
9. (Optional) Set Administrative Distances for static and dynamic routing.

   When the virtual router has two or more different routes to the same destination, it uses administrative distance to choose the best path, preferring a lower distance.

   1. Select Advanced SettingsAdministrative Distances.

   2. Set the administrative distances as required for your network.

      • Static—Range is 10 to 240; default is 10.
      • OSPF Internal—Range is 10 to 240; default is 30.
      • OSPF External—Range is 10 to 240; default is 110.
      • IBGP—Range is 10 to 240; default is 200.
      • EBGP—Range is 10 to 240; default is 20.
      • RIP—Range is 10 to 240; default is 120.
10. Configure the following settings:

    • Static Route
    • BGP
    • Multicast
    • OSPF
    • OSPFv3
11. Save.
12. Push Config to push your configuration changes.