AVI LB VIP advertise route prefix not getting removed from T0 on AVI detachment from T1 gateway
search cancel

AVI LB VIP advertise route prefix not getting removed from T0 on AVI detachment from T1 gateway

book

Article ID: 372253

calendar_today

Updated On:

Products

VMware NSX VMware Avi Load Balancer

Issue/Introduction

  • AVI creates /32 LB VIP static route on T1 gateway and its get advertised as T1_LB_VIP route on T0 gateway. Later if user does any changes in advertisement config of T1 gateway, same LB VIP prefix also gets advertised as T1_STATIC. There is no datapath issue but later when user detach AVI LB from T1 gateway, it only removes T1_LB_VIP advertise route from T0 gateway. T0 DR will still have T1_STATIC advertise route as stale entry.
  • Two scenarios can been seen when checking the get route on T0 SR VRF for the destination ip advertised by AVI. 
    1. If the new T1 is added in the same AVI VIP, and if you check get route in T0 you will two next hops. 
    2. In another case, when you check get route in T0 it will display the wrong T1 next hop which was removed previously. 
  • This issue can be reproduced by following steps:
    1. Create T1 gateway and attach AVI LB. You will see advertised prefix on T0 gateway as t1l
    2. Make any flag changes in T1 advertisement config. Now you will see advertised prefix as t1s instead of t1l
    3. Now detach AVI from T1 gateway, you will still see stale t1s prefix on T0 gateway.

Environment

VMware NSX
VMware NSX-T Data Center
VMware Avi Load Balancer

Cause

  • AVI LB VIP advertise route prefix not getting removed from T0 on AVI detachment from T1 gateway. As NSX can't remove AVI VIP advertised prefix from T0 gateway, customer can't use same VIP prefix on another T1 gateway.

Resolution

This issue is resolved in VMware NSX 4.2.0

Workaround:

  • Use the reprocess API on T1 gateway (use the T1 uuid which advertises the incorrect route)

POST https://<manager fqdn>/policy/api/v1/infra/tier-1s/{tier-1-id}?action=reprocess

  • Remove deny prefix rule in T1 gateway advertisement rules
  • You can also add a route filter in T1 which is advertising incorrect route to prevent the T0 from seeing the incorrect route.

Additional Information

Impact: As NSX isn't able to remove AVI VIP advertised prefix from T0 gateway, you can't use same VIP prefix on another T1 gateway

Powered by Wolken Software