Deployment · Topic 4 of 5
ECMP, Route Tracking and Clustering
Learn how ECMP zones share traffic over equal cost routes, how static route tracking with an SLA monitor fails over, and how clustering scales.
- 5 min
- Includes a diagram
- ECMP uses equal cost routes together through interfaces in a traffic zone.
- ECMP shares traffic per connection flow, so one flow stays on one path.
- Static route tracking uses an SLA monitor that sends ICMP echo requests.
What it is
ECMP, static route tracking and clustering are three more ways to keep Secure Firewall traffic flowing and to add capacity.
Equal-Cost Multipath (ECMP) spreads traffic over several routes that have the same cost. Static route tracking removes a static route when its next hop stops answering, so a backup route can be used.
Clustering joins several firewalls into one logical device. The members share the traffic load and take over from each other if one fails.
How it works
Each feature solves a different problem, and each has its own setup in the FMC.
ECMP routing
ECMP lets a firewall use more than one path to the same destination at once. The interfaces that take part are put into a traffic zone, often called an ECMP zone, in the routing settings of the device.
Routes to the same network through interfaces in that zone, with equal metrics, are used together. Traffic is shared per connection flow, using a hash of packet header details, so a single connection stays on one path.
ECMP works with static routes and with routes learned from dynamic routing protocols. It is useful with two internet links of similar quality.
Static route tracking
A static route stays in the routing table as long as its outgoing interface is up. That is a problem if the router beyond that interface fails but the link stays up.
With route tracking, the firewall checks the next hop using an SLA monitor. The monitor sends ICMP echo requests to a target, and if the replies stop, the tracked route is removed from the routing table.
A second static route to the same network with a higher metric then takes over. When replies return, the primary route is put back.
In the FMC, the SLA monitor is an object. You add it to the static route as the tracking option, and the route to the same network goes in twice with different metrics.
Clustering
Clustering combines several firewalls into one logical device. It is available on supported hardware such as the Firepower 4100 and 9300, and later releases added other platforms, so check the release notes for the current list.
Cluster members are called nodes. One is the control node and the others are data nodes. The control node holds the main configuration and pushes it to the rest.
Nodes talk to each other over the cluster control link. Data interfaces are usually configured as a spanned EtherChannel, which puts the member links from all nodes into one port channel on the switch.
How a connection is handled in a cluster
The switch hashes each new connection to one node. That node becomes the connection owner. A second node, the director, keeps a record of who owns the connection.
If packets arrive at a different node, that node is a forwarder. It asks the director for the owner and sends the packets there. This keeps both directions of a flow on one node for inspection.
Comparing the options
| Option | Protects against | Capacity gain |
|---|---|---|
| Port channel | Link failure | More bandwidth on one device |
| Failover | Device failure | None, one unit is idle |
| ECMP | Path choice, link load | Uses several links |
| Route tracking | Next hop failure | None |
| Clustering | Node failure | Adds throughput and connections |
Checking the result
> show route
> show cluster infoshow route lists the routes in use, where several equal routes show ECMP in action. show cluster info shows the cluster state and which node is the control node.
What to remember for the exam
Eight facts cover the usual questions here.
- ECMP uses equal cost routes together through interfaces in a traffic zone.
- ECMP shares traffic per connection flow, so one flow stays on one path.
- Static route tracking uses an SLA monitor that sends ICMP echo requests.
- When the monitor fails, the tracked route is removed and a backup route with a higher metric is used.
- Clustering joins nodes into one logical device with a control node and data nodes.
- Nodes use a cluster control link to communicate.
- Data interfaces normally use a spanned EtherChannel.
- A connection has an owner, a director and possibly a forwarder.
If a question describes a primary link that is up but unusable, the answer is static route tracking, not a plain static route.
Common mistakes
These four mistakes are common with these topics.
Expecting ECMP to split one connection. Balancing is per flow, so a single connection uses one path.
Forgetting the backup route. Tracking only helps if a second route with a higher metric exists.
Treating failover and clustering as the same thing. Failover keeps one unit idle, while clustering uses all nodes.
Ignoring the cluster control link. Cluster members depend on it, so it needs a healthy private path.
Route tracking checks one target. Pick a target that reflects the real path, because a target that is down for another reason can remove a good route.
Check yourself
Work through these three questions.
What does static route tracking use to decide that a route is bad?
It uses an SLA monitor that sends ICMP echo requests, and when the replies stop the tracked route is removed.
Which node keeps the main configuration in a cluster?
The control node holds it and pushes it to the data nodes.
How does ECMP share traffic between equal cost paths?
It shares traffic per connection flow, using a hash of packet header details, so one connection stays on one path.
Topic 4 of 5 in Deployment
Test yourself on Deployment
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.