3

Please find the network diagram,

We have MPLS and Internet connectivity in our some of spoke sites in Hub router running in IPSLA for failure purpose.

Here MPLS is the primary and VPN is the secondary. If primary link goes down failure is happened and working via VPN.

The issue is If i change the route priory as a VPN i can't access my application server. I can ping the ip and i can see the traffic via VPN but i can access the server and any thing.

Please help us me to troubleshoot the issue.

In some of spoke sites have both MPLS links that locations are working if i do above changes.

enter image description here

  • 1
    Your description isn't clear. Can you ping the application server from the spoke LAN? – Ron Trunk Jan 24 '17 at 13:39
  • @Ron Trunk I can ping my server IP from my spoke via VPN and MPLS but Name is not resolve – Karthick Whitey Jan 25 '17 at 4:39
  • If you can ping the server, I don't think asymmetrical routing is the problem. Can you ping your DNS server? – Ron Trunk Jan 25 '17 at 11:33
  • Yes i Can able to ping all of my segments but i can't access my application. – Karthick Whitey Jan 25 '17 at 13:13
  • Look at the firewall log. If it is dropping traffic, it will tell you. But from the information you provided, it doesn't seem to be a routing issue. If it were, your pings would fail too. – Ron Trunk Jan 25 '17 at 14:32
3

The answer is most likely in your question subject.

If you change the route priority at the spoke so that traffic comes in via the VPN/Firewall, then return traffic will still most likely leave via the MPLS network (if nothing else changes).

Your VPN firewall is most likely stateful, and will only have half a session in it's flow table eg: it will see the SYN, but no SYN/ACK, then when the client at the spoke sends the final ACK, the firewall will drop it because it is not in sync with the handshake.

  • your understood was correct, Shall we resolve the issue? – Karthick Whitey Jan 25 '17 at 4:41
  • ensure that Internal firewall has a preferred return route to spoke LAN back via the VPN firewall – Benjamin Dale Jan 27 '17 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.