Configure Routing Preferences
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Configure Routing Preferences
Learn how to configure routing preferences for Prisma
Access service connections.
Where Can I Use
This? | What Do I Need? |
---|---|
|
|
To enable routing preferences, complete the
following steps.
To configure these routing preferences, you must use BGP
routing and not static routing for your service connections.
- (Optional) Select the routing to use for your service connections.
- From the Panorama that manages Prisma Access, go toand click the gear to edit thePanoramaCloud ServicesConfigurationService SetupSettings.
- In theAdvancedsettings, select yourRouting Preference(eitherDefaultorHot Potato).
- (Optional, Hot Potato Routing Deployments Only) To specify a preferred service connection to use if a link fails, configure aBackup SCwhen you configure a service connection.You can select any service connection that you have already added. Prisma Access uses theBackup SCyou select as the preferred service connection in the event of a link failure. Selecting a backup service connection can prevent asymmetric routing issues if you have onboarded more than two service connections. This choice is available in Hot potato routing mode only.
- Go toPanoramaCloud ServiceConfigurationService Connection
- Select the service connection to configure, orAdda new one.
- Select a service connection to use as the preferred backup (Backup SC).
- Commit your changes to Panorama and push the configuration changes to Prisma Access.
- Click.CommitCommit and Push
- Edit Selectionsand, in the Prisma Access tab, make sure thatService Setupis selected in thePush Scope, then clickOK.
- ClickCommit and Push.
- Verify that your service connection is up by selectinPanorama > Cloud Services > Status > Statusand checking that its Status isOK.TheDeployment Statusarea allows you to view the progress of onboarding and deployment jobs before they complete, as well as see more information about the status of completed jobs.If the status is notOK, hover over the Status icon to view any errors.To see a graphical representation of the service connection along with status details, selectService Connectionon theMonitortab.Select a region to get more detail about that region.Click the tabs below the map to see additional information about the service connections.Statustab:
- Location—The location where your service connection is deployed.
- Remote Peer—The corporate location to which this s service infrastructure is setting up an IPSec tunnel.
- Allocated Bandwidth—The number of service connections you have allocated multiplied by 300 Mbps.This number does not reflect the available service connection bandwidth.While each service connection provides approximately 1 Gbps of throughput, the actual throughput is dependent on several factors, including:
- Traffic mix (for example, frame size)
- Latency and packet loss between the service connection and the headquarters location or data center
- Service provider performance limits
- Customer termination device performance limits
- Other customer data center traffic
- ECMP—If you have equal cost multipath (ECMP) configured for this service connection. Since ECMP is not used for service connections, this status isDisabled.
- Config Status—The status of your last configuration push to the service. If the local configuration and the configuration in the cloud match, the Config Status isIn sync. If you have made a change locally, and not yet pushed the configuration to the cloud, this may display the statusOut of sync. Hover over the status indicator for more detailed information. After committing and pushing the configuration to Prisma Access, the Config Status changes toIn sync.
- BGP Status—Displays information about the BGP state between the firewall or router at your corporate/headquarters location and Prisma Access where the service connection is established. Although you might temporarily see the status pass through the various BGP states (Idle,Active,Open send,Open pend,Open confirm, most commonly, the BGP status shows:
- Connect—The router at your data center/headquarters is trying to establish the BGP peer relationship with Prisma Access.
- Established—The BGP peer relationship has been established.
This field will also show if the BGP connection is in an error state:- Warning—There has not been a BGP status update in more than eight minutes. This may indicate an outage on the firewall.
- Error—The BGP status is unknown.
- Tunnel Status—The operational status of the connection between Prisma Access and your service connection.
Statisticstab:- Location—The location where your service connection is deployed.
- Remote Peer—The corporate location to which the service connection is setting up an IPSec tunnel.
- Ingress Bandwidth (Mbps)—The bandwidth from the HQ/data center location to Prisma Access.
- Ingress Peak Bandwidth (Mbps)—The peak load from the HQ/data center location into the cloud service.
- Egress Bandwidth (Mbps)—The bandwidth from Prisma Access into the HQ/data center location.
- Egress Peak Bandwidth (Mbps)—The peak load from Prisma Access into the HQ/data center location.
- QoS—Select this button to display a graphic chart that shows a real-time and historical QoS statistics, including the number of dropped packets per class. This chart displays only for service connections or remote network connections that have QoS enabled.
If you configured BGP, you can check its status by selecting.PanoramaCloud ServicesStatusNetwork DetailsService ConnectionShow BGP StatusThe BGP Status dialog displays. This table provides you with the following information:- Peer—Routing information for the BGP peer, including status, total number of routes, configuration, and runtime statistics and counters. The total number of routes display in thebgpAfiIpv4-unicast Countersarea, in theIncoming TotalandOutgoing Totalfields.
- Local RIB—BGP routes that Prisma Access uses locally. Prisma Access selects this information from the BGP RIB-In table, which stores the information sent by neighboring networking devices, applies local BGP import policies and routing decisions, and stores the Local RIB information in the Routing Information Base (RIB).Note that only the first 256 entries are shown. To view additional entries, enter a subnet or IP address in the Filter field and click Apply Filter to view a subset of the routing entries up to a maximum of 256.
- RIB Out—Routing information that Prisma Access advertises to its peers through BGP update messages.