ECMP Traffic Across Multiple Logical Routers

Consider the following topology on a standalone firewall:

• The firewall in this depiction is configured with 3 logical routers: A, B and C.
• Logical Routers A and B each have a WAN aggregation link for default routing.
• Logical Router C is peering with Logical Routers A and B respectively via BGP.
• Logical Routers A and B advertise a default route to C.
• Logical Router C installs the default route prefixes as equal cost paths; however, the firewall is dropping packets for default route traffic.

admin@pa-vm> show advanced-routing route logical-router LR_C destination 0.0.0.0/0

Logical Router: LR_C


==========================


flags: A:active, E:ecmp, Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext 1, O2:ospf ext 2






destination                             protocol       nexthop                                    distance  metric    flag      tag       age         interface          


0.0.0.0/0                               bgp            10.23.255.11                               20        0         A E                 00:20:49                


0.0.0.0/0                               bgp            lr LR_A                                    20        0         A E                 00:20:49                


0.0.0.0/0                               bgp            10.23.255.22                               20        0         A E                 00:20:49                


0.0.0.0/0                               bgp            lr LR_B                                    20        0         A E                 00:20:49 

• VM-Series NGFW
• Hardware NGFW
• PAN-OS
• Layer 3 Routing
• Advanced Routing Engine
• Legacy Routing Engine

The firewall is not installing the ECMP prefix/es on its FIB table:

admin@pa-vm> show advanced-routing fib logical-router LR_C ecmp yes

total logical-router present  :           1

total logical-router shown    :           1



--------------------------------------------------------------------------------
logical-router name: LR_C

destination           nexthop            flags  interface                mtu  weight  hit   nh_id/mask
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------

As a result of this, matching packets to the destination are dropped, because the firewall is unable to forward the packets:

admin@pa-vm> test advanced-routing fib-lookup logical-router LR_C ip 4.2.2.2

--------------------------------------------------------------------------------
runtime route lookup
--------------------------------------------------------------------------------
logical-router:   LR_C
destination:      4.2.2.2
result:
route not found
--------------------------------------------------------------------------------

Based on official documentation - this is considered expected behavior:

ECMP is not supported for equal-cost routes where one or more of those routes has a virtual router or logical router as the next hop. None of the equal-cost routes will be installed in the Forwarding Information Base (FIB).

Although the next hop IPs for the default routes in this example do not necessarily point to logical routers directly, the BGP next hop addresses recurse to different logical routers:

admin@pa-vm> show advanced-routing route logical-router LR_C | match 10.23

10.23.255.11/32                          static         lr LR_A                                  10        10          AE                   01w4d:02h:
10.23.255.12/32                          static         lr LR_B                                  10        10          AE                   01w4d:02h:

In other words, the lack of support for this feature across multiple virtual or logical routers includes recursive routes.