Secondary replication IP address not reachable on VMware Live Recovery appliance

Products

• VMware Live Recovery

Issue/Introduction

• You cannot ping the secondary IP address (eth1) configured for replication traffic on a VMware Live Recovery (VLR) appliance.
• The management IP (eth0) is reachable, but the replication network appears unresponsive from specific subnets (e.g., Jumpbox or VDI).
• Network packet captures show traffic arriving on eth1, but no response is sent back.

Environment

• VMware Live Recovery 8.x
• VMware Live Recovery 9.x
• Photon OS based appliances

Cause

This issue typically occurs due to asymmetric routing or Reverse Path Filtering (rp_filter) settings in the Linux kernel.

1. Asymmetric Routing: The appliance receives a packet on eth1, but the default gateway is configured on eth0. If the eth0 gateway does not have a route back to the source subnet (e.g., the jumpbox), the return packet is dropped or misrouted.
2. rp_filter: By default, many Linux distributions set net.ipv4.conf.all.rp_filter = 1 (Strict Mode). If the return path for a packet does not match the interface it was received on, the kernel drops the packet as a security measure.

Resolution

To resolve this issue, verify the routing path and adjust the kernel network settings.

1. SSH into the VMware Live Recovery appliance as root.

2. Verify the route the appliance uses to reach the source IP (e.g., your jumpbox IP):

ip route get ####.####.####.####

Note: Replace ####.####.####.#### with the IP of the machine attempting to ping the appliance.

3. If the output shows the traffic is being routed via eth0 instead of eth1, add a static route for that subnet via the eth1 gateway to ensure symmetric routing.

4. Check the current Reverse Path Filter settings:

sysctl -a | grep rp_filter

5. If the value for net.ipv4.conf.all.rp_filter or net.ipv4.conf.eth1.rp_filter is set to 1, change it to 2 (Loose Mode) to allow asymmetric routing:

sysctl -w net.ipv4.conf.all.rp_filter=2

sysctl -w net.ipv4.conf.eth1.rp_filter=2

sysctl -w net.ipv4.conf.default.rp_filter=2

6. To make these changes persistent across reboots, edit /etc/sysctl.conf and add or update the following lines:

net.ipv4.conf.all.rp_filter = 2

net.ipv4.conf.eth1.rp_filter = 2

net.ipv4.conf.default.rp_filter = 2

7. Restart the network service to apply changes:

systemctl restart systemd-networkd

Additional Information

NOTE: The above changed needs to be made only if it is extremely needed.