Anycast Gateways

Question

Can anyone shed light of anycast gateways. Typically Ive seen each pair of leafs within a fabric configured with MCLAG and a different IP used for the gw address across each pair of leafs. However, how does Anycast gateways work?

Ive been unable to find much on Google. Only that it is only achieved when using VXLAN/EVPN. However, I can see that ACI provides the ability to provide Anycast gateways without the use of VXLAN.

In short, my question is, how do Anycast Gateways work, and is it possible to configure them upon a fabric without the use of VXLAN/EVPN?

Answer 1

The answer to the second part of your question if Anycast Gateway can be implemented without VXLAN/EVPN, was given by the guy who (quite literally) "wrote the book", Lukas Krattiger, here:

https://learningnetwork.cisco.com/thread/122986#661288

From which (full quote of Lukas' answer, highlight by me)

if there are two VPC domains and you use HSRP on all the four (same VIP, same Group, same Password), there will be only ONE HSRP node becoming active, one becoming standby and two listen. On the VPC domain where you have HSRP active, you will see the first-hop forwarding and ARP response to happen while the traffic from behind the VPC domain with non-active HSRP will trombone to-be-route traffic towards the VPC domain that has the HSRP active.

In case you change the HSRP Group or Password between the different VPC domain, you get multiple HSRP active and as a result, the Switch will detect duplicate MAC/IP situation sourced by the SVI that has HSRP active (multiple). In addition, every ARP broadcast towards the VIP will result in duplicate response as you have two HSRP active.

In short, HSRP doesn't provide you a clean 4-way active but if you don't care on duplicates, log messages and other forwarding deficiencies, you can hack VPC and HSRP to do an all active.

To your answer "can I do distributed IP anycast gateway without VXLAN EVPN", the answer is NO. You always have to configure the VXLAN portion to make the distributed IP anycast gateway work. If you interconnect to VPC domains back-to-back where each has distributed IP anycast gateway, this would end it similar problem as above. Simple solution is don't use back-to-back VPC and VXLAN EVPN instead and use distributed IP anycast on all the host-facing nodes. We call this a small VXLAN fabric :-)

And I believe the other answers in that thread also help with the first part of your question how Anycast Gateways work:

With the distributed IP anycast gateway, the default gateway is moved closer to the endpoint--specifically to the leaf where each endpoint is physically attached. The anycast gateway is active on each edge device/VTEP across the network fabric, eliminating the requirement to have traditional hello protocols/packets across the network fabric. Consequently, the same gateway for a subnet can be used concurrently at multiple leafs, as needed, without the requirement for any FHRP-like protocols. (Building Data Centers with VXLAN BGP EVPN: A Cisco NX-OS Perspective, at page 66.)

And an extension to that from Lukas, (again, highlighting by me)

to add some additional comments

the SVI representing the distributed IP anycast gateway announces its IP and MAC address only towards the host facing Ethernet ports but not towards the fabric (Overlay). As a result, the MAC/IP for the distributed IP anycast gateway is only seen and reachable from the host facing side and never from the fabric (Overlay) facing side. This is rather important as there is no duplicate MAC/IP in the overall network topology for the first-hop gateway and also ARP handling is very deterministic (host facing).

In traditional Ethernet networks, such a host vs. fabric facing topology determination doesn't exists. The challenges around this missing awareness has been addressed through FHRPs that deals with for example the ARP handling. In order to ensure only one of all FHRP nodes is responding to an ARP request, you need to define a "master" and this is where the FHRP hellos and election are coming into the game.

hope that adds some clarity

Answer 2

Anycast is when you terminate IP addresses in multiple locations in a network and make each location fully functional. Advertising these routes then takes care of each client using the shortest path = geographically nearest termination point.

What exact method is used behind the anycast scheme is up to the architect. It may be just a routing shortcut (to make sure you enter the provider's network at your nearest location) or the service may actually exist on multiple locations. Likewise, an anycast address may be destination translated at some point or it may actually be terminated on a server (as a secondary address usually).