DC Symmetric Return with Branch Gateway Co-existence
Learn how symmetric routing is maintained when a branch and Branch Gateway connect to
different ION devices in a clustered data center.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma SD-WAN (Managed by Strata Cloud Manager)
|
- Prisma SD-WAN
- Physical and virtual ION devices running software version 6.8.1
and higher for Branch Gateway symmetric routing
|
In triangular deployment scenarios where a branch and a Branch Gateway maintain separate
active connections to different ION devices in a clustered data center, return traffic
from the core network may flow along an unexpected path. This routing asymmetry can
increase latency and disrupt TCP sessions, particularly when Zone-Based Firewall
policies are enforced at the Branch Gateway.
For branch-to-branch traffic that transits the data
center, you can configure prefix filters on the Branch Gateway to direct traffic over
direct branch-to-branch fabric connections rather than through the data center.
The following example shows routing asymmetry between a branch and two Data Center ION
devices.
In this scenario:
- Outbound traffic: The branch uses a direct VPN path to Data Center ION
1.
- Return traffic: The core network routes return traffic through Data Center
ION 2 and a Branch Gateway transit path.
Prisma SD-WAN maintains symmetric routing across the data center cluster. The system
dynamically adjusts route advertisements based on the VPN state of the branch and Branch
Gateway paths.
Route advertisements operate based on path status:
- Direct VPN path active: Prisma SD-WAN prefers the direct VPN path between the
branch and the data center ION device.
- Direct path inactive, Branch Gateway reachable: The system applies Metric 30
to the transit path. This metric retains the path as a secondary backup.
- Both paths unavailable: The system withdraws the branch prefix from the core
network.
This route management mechanism supports both BGP and OSPF deployments.
Routing Behavior
Prisma SD-WAN maintains symmetric routing between the data center core and the
branch. The system dynamically adjusts route advertisements based on the connection
state between the branch, Branch Gateway, and data center ION devices.
Dynamic route management maintains symmetric traffic flow between the data center
cluster and the core network. This symmetry prevents session failures and reduces
latency by ensuring return traffic follows the forward traffic path.
Traffic routing operates under the following conditions:
- Core-facing traffic: The routing engine monitors connection states and
updates route advertisements to preserve symmetry. For traffic from the Data
Center core, the engine steers traffic to the DC ION device with the active
direct VPN path. If the direct path fails, the system routes traffic to the
Branch Gateway backup path.
- Non-core interfaces: Symmetry enforcement does not apply to Data Center
Interconnects (DCI), other branches, or Branch Gateways. The system cannot
influence remote VPN status based on prefix hop counts for these paths.
Routing Decision Matrix
| VPN State for Prefix | Hop-Count 2 Active | Hop-Count 2 Inactive |
|---|
| Hop-Count 1 Active | No Metric Applied | No Metric Applied |
| Hop-Count 1 Inactive | Set Metric 30 | Do Not Advertise |
Example Prefixes
| Prefix | VPN State | Action |
|---|
| 11.11.11.0/24 | Inactive HC1 + Active HC2 | Set Metric 30 |
| 14.14.14.0/24 | Active HC1 | Advertise without metric |
| 16.16.16.0/24 | Inactive HC1 + Inactive HC2 | Do Not Advertise |
OSPF is not supported when clustered Data Center ION devices share a common core
subnet.
Route metrics are not supported when VRF route leaking is enabled.
For OSPF deployments, BGP-to-OSPF prefix redistribution uses system route-maps to
apply the Metric 30 backup metric. If you configure a custom redistribution
route-map, it overrides the system route-map and prevents the Metric 30 backup
metric from being dynamically applied.
