Please find the network diagram,

We have MPLS and Internet connectivity in our some of spoke sites in Hub router running in IPSLA for failure purpose.

Here MPLS is the primary and VPN is the secondary. If primary link goes down failure is happened and working via VPN.

The issue is If i change the route priory as a VPN i can't access my application server. I can ping the ip and i can see the traffic via VPN but i can access the server and any thing.

Please help us me to troubleshoot the issue.

In some of spoke sites have both MPLS links that locations are working if i do above changes.

enter image description here

  • 1
    Your description isn't clear. Can you ping the application server from the spoke LAN?
    – Ron Trunk
    Jan 24, 2017 at 13:39
  • @Ron Trunk I can ping my server IP from my spoke via VPN and MPLS but Name is not resolve Jan 25, 2017 at 4:39
  • If you can ping the server, I don't think asymmetrical routing is the problem. Can you ping your DNS server?
    – Ron Trunk
    Jan 25, 2017 at 11:33
  • Yes i Can able to ping all of my segments but i can't access my application. Jan 25, 2017 at 13:13
  • Look at the firewall log. If it is dropping traffic, it will tell you. But from the information you provided, it doesn't seem to be a routing issue. If it were, your pings would fail too.
    – Ron Trunk
    Jan 25, 2017 at 14:32

1 Answer 1


The answer is most likely in your question subject.

If you change the route priority at the spoke so that traffic comes in via the VPN/Firewall, then return traffic will still most likely leave via the MPLS network (if nothing else changes).

Your VPN firewall is most likely stateful, and will only have half a session in it's flow table eg: it will see the SYN, but no SYN/ACK, then when the client at the spoke sends the final ACK, the firewall will drop it because it is not in sync with the handshake.

  • your understood was correct, Shall we resolve the issue? Jan 25, 2017 at 4:41
  • ensure that Internal firewall has a preferred return route to spoke LAN back via the VPN firewall Jan 27, 2017 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.