asymmetric routing issue

[rhap4boyz]

 

Simplified example diagram.

We currently have dual ISPs, dual routers, dual firewalls with single AS with two subnets. As an example, 10.10.10.0/24 and 20.20.20.0/24.  Both ISPs passes BGP default route to the routers. Both routers runs HSRP. 

Server 2 is able to ping 10.10.10.1 on the firewall interfaces.  However when Server 2 pings 20.20.20.1, it gets dropped because of asymmetric routing.  What would be the correct way to fix this issue?

[MHM Cisco World]

the ONLY think here the the Edge router use two path toward the Server Subnet one via 10.10.10.x and other via 20.20.20.x 
you must config static route OR IGP which prefer one path not use ECMP

[rhap4boyz]

Thank you for the fast response.  Currently Router 1 and Router 2 communicate with Firewall 1 and 2 via BGP. 

Where should this preference be set? Router1? Firewall 1? using weight?

If I want incoming traffic from Server 2 to use ISP1 for subnet 10.10.10.X as primary and ISP2 for subnet 20.20.20.X as primary and failover to each other for those subnets, how should the routing be configured? Could you give an example?

[MHM Cisco World]

Why you use BGP inside between FW and Edge routers?
anyway 
for FW to prefer the path though the ISP1 edge router1 use weight in FW 
for Edge router to prefer path through the 10.10.10.x use weight in Edge router. 

the Cisco devices prefer the path with highest Weight 

[rhap4boyz]

Got it.  Thank you for the explanation.

There were some errors in the diagram.  Here is an updated diagram.  I remove the switches to simplify the diagram.  Both Router1 and Router2 are in AS 400.  However, they do not have each other as BGP neighbors.

Router1 and Router2 both have Firewall 1&2's VIP as BGP neighbor using the 20.20.20.X network.

Should Router 1 and Router 2 be BGP neighbors to each other?  That probably explains why Server2 can reach Router1 but can't reach Router2 at 20.20.20.12 when ISP2 goes down?

Should this designed in a different way in your opinion?  If so how?

[MHM Cisco World]

the FW HA meaning only the FW1 is run BGP with both Router1 and Router2 
the issue is the traffic OUTbound from FW1 via 10.10.10.0 and return via 20.20.20.0 
so start in FW1 share show route 
and in router1 and router2 show ip route 
let me check