4
If I understand correctly you are performing NAT for your traffic going to the Internet on RTR1 and RTR2.
If the NAT tables are not synched between those 2 routers, then if a NAT translation is performed on RTR1 for example, but the answer come through ISP2 to RTR2, then RTR2 doesn't have a NAT entry for this traffic and cannot forward it to the originating ...
1
If routes to the same destination end up with equal cost on the PA, it'll use ECMP to distribute traffic across both RTRs (depending on configuration), possibly using different public IPs for NAT. While this may work with some protocols (like UDP) it definitely won't with others (like TCP). TCP's SYN may go one way, and data segments the other - that can't ...
1
If you move your NAT to the Palo Alto unit(s), you wouldn't have any issues with NAT on the ISRs, and you'd just route traffic accordingly via access segments, with whatever routing method you choose and whatever route preference or prepending you choose, to prefer one path over the other.
Only top voted, non community-wiki answers of a minimum length are eligible
