Additional ECMP Settings
Table of Contents
Additional ECMP Settings
Let us learn more about the additional ECMP settings.
After you complete the basic configurations
of ECMP, there are a few additional ECMP-related settings. Follow
the sections to learn about each.
ECMP Region Location Detection
In version
2.0.3 onwards, ECMP automatically detects the closest Prisma Access location
for a branch to connect. The closest location is determined by the
values of Latitude/Longitude entered in the Site Details for a branch.
The
CloudBlade API determines the country, and the local language support
for the branch via the location. Wherever possible, it will connect
that branch to the appropriate Prisma Access region with the language
support for the country that the branch is in.
If a more
deterministic behavior or region is required, the region can be
changed manually to a desired region, as shown:
ECMP Bandwidth Detection
Starting with
version 2.0.1, ECMP uses the circuit bandwidth to automatically
set the Prisma Access bandwidth. To override this behavior, adjust
the bandwidth for ECMP accordingly.
ECMP Configuration for a Single Link
Some
organizations that plan on having two or more connections to a branch Prisma
SD-WAN ION device can pre-configure ECMP with only a single link
to a device. When configuring ECMP on a single link, the following
notes/restrictions will apply.
- The minimum bandwidth for ECMP in Prisma Access is 50 Mbps
- Prisma Access will allocate 50 Mbps to a single link, in preparation for ECMP.
- The link will appear as a non-ECMP link in Prisma Access.
- When a second link is configured/enabled for Prisma Access, the site will automatically enable ECMP with symmetric return in Prisma Access.
ECMP Circuit Usage and Exemption
By default,
ECMP will build a Standard VPN to Prisma Access on up to four interfaces which
are able to reach Prisma Access. This can include, but is not limited
to Internet circuits (Cable, DSL, 3G/4G/5G/LTE) and Private WAN
Circuits (MPLS).
ECMP does NOT look at the circuit category
to bring up a path to Prisma Access. Rather, it looks at whether
or not the circuit for a device has reachability to Prisma Access
in order to add to the ECMP bundle.
There can be situations
where certain circuit categories at a global level or circuits at
a device level should be excluded or allowed to participate in ECMP.
For example, Private WAN paths may not be required at an organization
to become part of an ECMP bundle.
To accomplish this, the
following tag can be applied globally or at the device level: prisma_ecmp_exclude
Application
of the tag at the Device Interface or Global level will prevent
ECMP from using that category or port for inclusion.
ECMP Branches with High-Availability
The
2.0.3 CloudBlade version also supports High-Availability designs,
while allowing for licenses to be consumed by the Primary/Active
Prisma SD-WAN ION device, while the backup Prisma SD-WAN ION device
does not consume a license to Prisma Access.
To enable ECMP
HA licensing, under the PRIMARY/ACTIVE Prisma SD-WAN ION device,
enable the following prisma_ha_primary tag as shown.
This signals
to the CloudBlade to replicate the Standard VPN tunnels to Prisma Access
to the backup/secondary unit. In the event of a changeover to the
secondary Prisma SD-WAN ION device, the tunnels are already configured,
but do not consume licensing.