3

We made did a campus LAN upgrade recently, during which we migrated from a mixed EIGRP/OSPF IGP to a multi-area OSPF redistributing to/from BGP on our WAN. We have two entry points on different sides of the campus with two different AS' numbers, so not running iBGP. We accidentally introduced asymmetric routing to our WAN, which we bandaided with static routes. We're working on changing the routing - using the same AS and running iBGP between the two routers to the WAN, sending community strings changing the provider's local pref, etc.

Question is: Why did the asymmetric routing - going out router1, coming back router2 - why did it matter to the applications? How do the applications know there's asymmetric routing? What immediately broke for us was XEN desktops, and Microsoft Remote Desktop. I can understand how the network would be able to tell with something like URPF, but why does it matter to applications and how do they know?

  • 8
    We need a lot more detail about how / what broke, as well as why this was blamed on the asynchronous paths. If you have multiple firewall clusters that are not source NAT-ing traffic, it's possible that they were getting traffic that was rejected because they did not have a state-entry for the return traffic – Mike Pennington Jul 26 '13 at 19:45
  • I think @MikePennington hit the nail on the head. Probably a firewall state issue. – generalnetworkerror Jul 28 '13 at 7:29
  • +1 from more, this is going to bugger up NAT which you most likely have. Also, please edit the question to give some more topological detail. – jwbensley Jul 28 '13 at 12:49
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 14:14
4

If you're doing NAT on your WAN routers, that would definitely get you. You'd create a dynamic translation on Router1 as that is your best path to the destination. The destination then uses a different path to get to the source, and uses Router2. Router 2 has no NAT entry for that IP, and drops the traffic.

I've got my money on NAT issues. Stupid NAT! =)

0

they shouldn't, and it shouldn't matter. Asymmetric routing is a feature of the Internet and it also happens outside your control, ie. upstream. I'd look at something else (blackholing?) for a root cause. The only way asymmetric routing should matter is when using strict uRPF, but you've stated that already so I assume it's not that.

0

Async routing does not matter IF both links are the same from a bandwidth/latency/drops etc. It would be that 1 link is not as good as the other and the app never used it and now it does. Also if you are say redistribute into OSPF with E2 then both links will not include costs to get to them inside the campus so also consider the location relative to the location of the 2 links are they equidistant

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.