topic Fabric Edge Node not reaching outside Fabric in Software-Defined Access (SD-Access)

Fabric Edge Node not reaching outside Fabric

techno.it — Sat, 23 Nov 2024 16:06:10 GMT

I just prepared a small setup with 2 separate borders with LISP Pub/Sub and Nexus Switch as Fusion. On Fusion switch I have a network 172.16.1.0/24 with SVI IP 172.16.1.1 on GRT.

Injected a route (172.16.1.0/24) from Fusion Global Routing table to Border nodes into GREEN VRF. Route is received on Border1 in GREEN VRF. Route is registered in LISP on BN/control plane nodes. From the Border I can ping 172.16.1.1 using source anycast gateway (Loopback1023) within GREEN VRF ( ping vrf GREEN 172.16.1.1 sour Lo1023)

But I cannot ping from Edge Node using the same source anycast gateway ( SVI 172.16.1.1). Appreciate any advise.

This is just a test lab for now to understand more on packet flow and routing.

Re: Fabric Edge Node not reaching outside Fabric

Andrii Oliinyk — Sat, 23 Nov 2024 16:29:10 GMT

is NX-OS switches vPC'ed? if so u seems hitting the same rakes u've been advised to avoid

Re: Fabric Edge Node not reaching outside Fabric

techno.it — Sat, 23 Nov 2024 16:43:09 GMT

Thanks @Andrii Oliinyk

I guess figured it out. I think it is normal edge to not ping any external destination using an overlay interface/anycast gateway.

Anycast gateway on edge is the loopback IP on the Border so kind of duplication.

I am not sure too deep technically on this but if you can shed some light.

Re: Fabric Edge Node not reaching outside Fabric

Andrii Oliinyk — Sat, 23 Nov 2024 16:45:56 GMT

whatever the reason. be advised to stop using vPC as IP-peering entity unless u made pure L3-setup over it.

Re: Fabric Edge Node not reaching outside Fabric

Andrii Oliinyk — Sat, 23 Nov 2024 16:58:37 GMT

with NX-OS vPC rule is simple, use it for L3-peering with pure L3-precautions.

Re: Fabric Edge Node not reaching outside Fabric

techno.it — Sat, 23 Nov 2024 17:08:44 GMT

Sure thank you @Andrii Oliinyk

vPC will be still L2 transit only between Border and Fusion Firewalls

Re: Fabric Edge Node not reaching outside Fabric

Andrii Oliinyk — Sat, 23 Nov 2024 17:30:27 GMT

f u want to ping EN's VRFs from out of the fabric set unique Los per edge node per VRF

Re: Fabric Edge Node not reaching outside Fabric

aans307 — Wed, 12 Feb 2025 23:17:16 GMT

Have you manage to figure it out, I am stuck under same issue.

Re: Fabric Edge Node not reaching outside Fabric

Andrii Oliinyk — Thu, 13 Feb 2025 07:46:54 GMT

what is your problem exactly?
do u use vPC as single point of peering with borders?
or you cannot ping from ENs destinations outside the EN with AcGW as source?