North to South communication failing in a stretched Tier0(Active/Active) setup for few flows, with Tier1 router being in Active/Standby HA mode.
Article ID: 419595
Updated On:
Products
Issue/Introduction
- In a federated deployment with active Tier-0 at two sites ( which are in Primary/Primary configuration).
- Tier-0 external interfaces are URPF disabled.
- However, when traffic enters edges at either of the sites, it is observed on the edge uplinks but fails to reach VMs at either of the sites.
- Tier-1 router is in Active/Standby HA mode. However, no stateful services are being used.
Environment
VMware NSX
Cause
Hairpinning: If the Active Edge Node on Tier-1 router was not the same one used by the T0 router for the return traffic (the source of the earlier URPF issue), traffic pathing through the centralized SR could still be non-optimal and lead to internal confusion or state loss. This hairpinning is caused by asymmetric routing in the physical network.
Resolution
Since, this asymmetric routing problem is deemed to be outside the scope of NSX. Hence, recommendation would be to fix the asymmetric routing issue on the physical network.
Workaround: The asymmetric routing issue can be resolved by transitioning the HA configuration on the affected Tier-1 router from Active/Standby to Distributed mode. This change implements a fully distributed, stateless routing path.
Additional Information
Feedback
