A branch runs FTD in routed mode between the LAN and two ISP uplinks that reach the same remote prefixes. The network team wants outbound flows load-balanced across both links during normal operation, and every session must still be matched and inspected by the state that saw the first packet. Which ECMP approach meets both requirements?
Select an answer to reveal the explanation.
Short Explanation
When you install equal-cost routes with matching metrics, you’ll get outbound connections balanced across both links, with each session pinned to the path that saw its first packet. It’s like assigned seating that keeps a group together: flow-based hashing preserves the stateful inspection match instead of flipping packets between paths.
Full Explanation
Equal-cost multipath works when the routing table offers the same destination through next hops with equal-cost routes. Threat Defense then uses flow-based hashing to select a path for a connection, rather than alternating individual packets. This supports stateful inspection by keeping the connection on its selected path. A primary-plus-backup design with a higher metric fails the load-balancing requirement, since the backup route is not used while the primary is available. Alternating individual packets is not the FTD ECMP behavior described here and can disrupt packet ordering. Policy-based routing that sends all LAN traffic to one ISP link does not load-balance flows across both links. Verify the equal-cost routes in the routing table and check that connections use both paths.