North to South communication failing in a stretched Tier0(Active/Active) setup for few flows, with Tier1 router being in Active/Standby HA mode.

Products

• VMware NSX

Issue/Introduction

• In a federated deployment with active Tier-0 at two sites ( which are in Primary/Primary configuration).
• Tier-0 external interfaces are URPF disabled. 
• However, when traffic enters edges at either of the sites, it is observed on the edge uplinks but fails to reach VMs at either of the sites.
• Tier-1 router is in Active/Standby HA mode. However, no stateful services are being used. 
• Asymmetric routing is observed on the physical network side.

Environment

VMware NSX

Cause

Hairpinning: If the Active Edge Node on Tier-1 router was not the same one used by the T0 router for the return traffic, traffic pathing through the centralized SR could still be non-optimal and lead to packet loss. This hairpinning is caused by asymmetric routing in the physical network.

Resolution

Since, this asymmetric routing problem is deemed to be outside the scope of NSX. Hence, recommendation would be to fix the asymmetric routing issue on the physical network. 

Workaround: The asymmetric routing issue can be resolved by transitioning the HA configuration on the affected Tier-1 router from Active/Standby to Distributed mode. This change implements a fully distributed, stateless routing path. Below is the procedure to follow.

1. Navigate to Networking > Tier-1 Gateways.
2. Select the Tier-1 Gateway and click Edit.
3. Change the HA Mode to Distributed Only.
4. Click Save

Additional Information

Reference doc