I've got a somewhat basic iBGP configuration with a routing instance "global" between two Juniper vSRX's - each Juniper vSRX has an uplink of its own from a different transit provider with a default route. The iBGP within the routing instance "global" works as expected, failing over nicely between the two.
However, when adding another routing instance into play, let's say "client-1" with a default route with a next-table of "global.inet.0" traffic does not flow when ingressing or egressing through the other vSRX.
Outbound is sort of fine, because I can put equal preference on the routes out via iBGP and the local transit, but obviously inbound is beyond my control - so in the example below if Transit 2 was my inbound route 1.2.3.4 would not be pingable but 1.2.3.5 would be.
I've checked the basics such as host-inbound stanzas on the security zones, global ping is enabled, etc.
When pinging 1.2.3.4 and Transit 2 is the inbound route in the example, vSRX 1 can see the ping packets arriving (the correct place) but no ICMP response is given:
vsrx2# run show security flow session destination-prefix 1.2.3.4/32
Session ID: 289005, Policy name: self-traffic-policy/1, Timeout: 6, Valid
In: home.ip/2103 --> 1.2.3.4/31;icmp, Conn Tag: 0x0, If: ge-0/0/2.203, Pkts: 1, Bytes: 60,
Out: 1.2.3.4/31 --> home.ip/2103;icmp, Conn Tag: 0x0, If: .local..7, Pkts: 0, Bytes: 0,
Total sessions: 1
Interestingly, a loopback on vSRX 1 in this case that sits in the "global" routing instance, with the route in via Transit 2 is reachable.
Any ideas why the ping packets arrive in the right place, but do not get a response?