Cisco
Login
Search
Software Secure Firewall Threat Defense
Platform Secure Firewall Threat Defense Virtual
Activity Onboard

Routing ECMP Configuration Example for ECMP

Last updated: Jul 29, 2025

Configuration Example for ECMP

This example demonstrates how to use Firewall Management Center to configure ECMP zones on Firewall Threat Defense such that the traffic flowing through the device is handled efficiently. With ECMP configured, Firewall Threat Defense maintains the routing table per zone basis, and hence it makes it possible to re-route the packets in the best possible routes. Thus, ECMP supports asymmetric routing, load balancing, and handles lost traffic seamlessly. In this example, R4 records the two paths to reach the external file server.

Configuration example for ecmp
Figure 1: Configuration Example for ECMP

Procedure

1

Create virtual router—R4 with Inside1, Outside1, and Outside2 interfaces:

Configuring R4 virtual router
Figure 2: Configuring R4 Virtual Router
2

Create ECMP zones:

  1. In the Routing tab, choose R4 user defined virtual router, and then click ECMP.

  2. Click Add.

  3. Enter the ECMP name and from the Available Interfaces list, choose Outside1 and Outside2:

    Creating ECMP zone
    Figure 3: Creating ECMP Zone

  4. Click Ok, and then Save.
3

Create static routes for the zone interfaces:

  1. In the Routing tab, click Static Route.

  2. From the Interface drop-down list, select Outside1.

  3. Under Available Network, choose any-ipv4 and click Add.

  4. Specify the next-hop address in the Gateway field, 10.1.1.2:

    Static route for outside1
    Figure 4: Configuring Static Route for Outside1

  5. Configure the static route for Outside2, repeating from Step 3b to Step 3d.

Ensure to specify same metric, but different gateways for the static routes:

Static routes of ECMP zone interfaces
Figure 5: Configured Static Routes of ECMP Zone Interfaces
4

Save and Deploy.

The network packets to reach its destination, R3, follows R4>R1>R3 or R4>R2>R3, based on the ECMP algorithm. If R1>R3 route is lost, the traffic flows through R2 without any packet drops. Similarly, the response from R3 can be received by Outside2 though the packet was sent from Outside1. In addition, when the network traffic is heavy, R4 distributes them between the two routes and thus balances the load.

Previous topic Remove an ECMP Zone Next topic Bidirectional Forwarding Detection Routing