South-North communication failure in Active-Active VRF-Lite gateways

Products

• VMware NSX

Issue/Introduction

• South-North traffic blackholing can be observed in VRF T0 gateways, if the same is configured with Active-Active Edges and no BGP neighbors on some of these Edges.
• Inter-SR iBGP is not configured on VRF T0 gateway.

Environment

VMware NSX

Cause

This is an expected behavior:

• In case of Active-Active VRF gateways, it does not have a mechanism to respond to a communication failure that is independent of the Parent Tier-0 gateway's mechanism
• T0 DR has ECMP routes to T0 SRs of all Edge nodes, and traffic is hashed to all SRs regardless of their Northbound BGP status.
• Due to this, the traffic from South to North can get forwarded to the Edge nodes that do not have any BGP neighbors configured, resulting in traffic blackholing.

Resolution

Configure Inter SR iBGP on VRF T0 gateway:
https://techdocs.broadcom.com/us/en/vmware-cis/nsx/vmware-nsx/4-2/administration-guide/tier-0-gateways/tier-0-vrf-gateways.html