Packet loss in Stretched Active-Active Tier-0 Gateway with Primary and Secondary Locations
Article ID: 411988
Updated On:
Products
VMware NSX
Issue/Introduction
- In a federated deployment with active T0 at two sites, traffic entering edges at the primary site routes correctly to VMs at both primary and secondary sites.
- However, when traffic enters edges at the secondary site, it is observed on the edge uplinks but fails to reach VMs at either the primary or secondary site.
- When the asymmetric routing behavior prevalent in this environment.
Environment
VMware NSX 4.X
Cause
- Despite correct advertisement and reception of routes, packet captures confirm ICMP requests arriving at the Edge uplink, and the path to the impacted VM shows delivery to the downlink port.
- However, RPF (Reverse Path Forwarding) statistics are consistently increasing, indicating drops due to RPF.
- When RPF is enabled, the Edge strictly forwards packets only if they are received on the same interface that would be used to forward traffic back to the packet's source. In an asymmetric routing environment, if the route to the source address is via a different interface than the ingress interface, the packet is dropped by RPF.
Resolution
- Disable URPF (Unicast Reverse Path Forwarding) on the external tier-0 interfaces.
- Disabling URPF will allow traffic to egress on a different interface/path than the one it ingressed on, accommodating the asymmetric routing behavior prevalent in this environment.
Additional Information
Feedback
Yes
No
Powered by
