topic Using Flex configuration for PBR in Network Security

Using Flex configuration for PBR

NetworkMonkey101 — Tue, 25 Mar 2025 11:48:43 GMT

Hi,

I am looking to use flex configuration to push a subnet traffic down a 3 VTI tunnels in ECMP.

I am wanting the traffic to be load balanced or round robin. How is this achievable if each VTI has a different tunnel IP.

Re: Using Flex configuration for PBR

M02@rt37 — Tue, 25 Mar 2025 11:59:21 GMT

Hello @NetworkMonkey101

By configuring dynamic routing you could achieve ECMP load balancing over the three VTI.

When using a dynamic routing protocole, the router learn multiple routes to the same destination via the three VTIs. If these routes have the same cost (ospf) or feasible distance (eigrp), the router installs all of them in the routing table, allowing CEF to distribute traffic across them.

=> By default, CEF performs per-destination load balancing, meaning packets from the same flow always take the same path. However, CEF can also be configured for per-packet load balancing, ensuring a round-robin distribution across all tunnels.

https://www.cisco.com/c/en/us/td/docs/ios/12_4t/ip_switch/configuration/guide/tceflbs.html#wp1046328

Re: Using Flex configuration for PBR

Rob Ingram — Tue, 25 Mar 2025 14:22:23 GMT

@NetworkMonkey101 FTD uses traffic zone for ECMP. You associate VTI interfaces with ECMP zones and configure ECMP static routes to achieve the following:

Load balancing (Active/Active VTIs)—Connection can flow over any of the parallel VTI tunnels.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/vpn-s2s.html