ECMP behaviour on FMC managed FTD 7.2.4

[atsukane]

Hi All,,

We've just enabled ECMP with two 1Gbps AWS direct connect links over the weekend.

The ECMP zone is created in the global routing table, we didn't use VRF, and added equal cost static routes destined to AWS networks in the global routing table. Both interfaces belong to the same security zone.

I would have thought that the traffic will be load balanced and we'd see similar level of utilisation, however, it would appear from the netflow stats that one interface is more heavily used that the other. Any ideas?

Many thanks,

[tvotna · Accepted solution]

The difference is dramatic, but let me ask: is it a production with lots of random connections or you're testing the setup by generating some traffic? The thing is: the firewall distributes connections over ECMP links by 6-tuple hash (the hash takes ingress interface into consideration), and not packets, so utilization might be unequal because of this.

[MHM Cisco World]

the load balance not per-packet but per destination IP and L4 destination Port (if source IP and L4 port is same)
from cisco doc.

[atsukane]

thank you both. oddly, as the day went by, it seems to be handling similar amount of traffic now.

We'll keep on monitoring and see how this goes. 

[atsukane]

we've monitored throughout yesterday and this morning and now the ECMP seems to be doing what it supposed to do.

(@tvotna this is for a production with lots of random connections.)

Only thing is that we have an "*" asterisk on one of the routes, this is not just for this network in the screenshot but for all other routes, which make us think one is preferred over the other despite the equal metric.

[MHM Cisco World]

no friend 
the "*" meaning that this route will use for next packet 
now use different destination and check * is it appear with same route or not
MHM

[atsukane · Accepted solution]

Thanks.

I've checked and the AWS-1 always have the asterisk 

[atsukane]

Just reporting back after monitoring the behaviour for a week and it would appear it sorted itself out.