Hello Ankit,
all your issues are originated by the usage of security feature CBAC
the ip inspect commands on the LAN internal interface.
Without CBAC in place asymmetric routing wouldn't be an issue.
Also what kind of MPLS service are you using?
If it is a L3 MPLS VPN and you are using OSPF, your devices are peering with ISP PE routers.
From what you have written my guess is that you are using an MPLS L3 VPN service with multiple sites.
In a case like yours to support multiple links and also avoid asymmetric routing that would stop traffic for the presence of CBAC configured on your devices you need to work with the ISP tech people asking them to configure their PE routers accordingly.
Because if you have an MPLS L3 VPN service the choice of the path can be different from different remote sites depending on how the remote site serving PE sees the two PE nodes serving your local site.
For example if you explain your needs to the ISP engineers that can make one PE's routes more preferred everywhere for example by setting a local preference of 150.
There are also two aspects of OSPF configuration that make me think:
a)
why you have configured under OSPF process
max-metric router-lsa
This command should be used carefully as it increses the cost of each link in the router LSA to maximum intra area cost of 65,535.
This command does not allow your routers to differentiate their cost to the internal network to the PE routers.
I think you should remove it.
b) How you make a path preferrable over the other ?
I would expect you to tweak the OSPF costs to the internal network in order to make the primary link/ router preferred.
Something like:
primary router
interface gi0/2
ip ospf cost 20
secondary router
interface gi0/2
ip ospf cost 2000
But as mentioned before to make this change effective from the point of view of PE nodes you need to remove the max-metric comand under router ospf.
Hope to help
Giuseppe
