asymmetrical routing BGP - nexus 7ks

[Kumar99]

Hi All ,

I am testing the below topology and need inputs from experts on how to stop asymmetrical routing .

As per the above diagram , 

Traffic from LAN to WAN &&& WAN to LAN of Data centers is as below

--------------------------------------------------------------

LAN subnet of data center 1  <----> nexus 7ks  (DC1)  <---> EBGP  <----> Cisco ACI (DC1 )  <---> WAN 

LAN subnet of data center 2  <----> nexus 7ks  (DC2)  <---> EBGP  <----> Cisco ACI (DC2 )  <---> WAN 

LAN to LAN communication between DC's is as below

----------------------------------------------

LAN subnet of data center 1  <----> nexus 7ks  (DC1)  <---> DCI LINK (EBGP)   <----> nexus 7ks  (DC2)  <---> LAN subnets of Data Center 2 

Asymmetrical routing happens if

LAN subnet of Data center 1 Nexus 7ks  --- EBGP --- Cisco ACI (Data center 1 )  -------DCI connectivitiy ------ ( Data center 2) Cisco ACI  ----EBGP Nexus 7ks ( Data center 2) and same is applicable from lan subnets of Data center 2 to lan subnets of Data center 1 .

Can somebody give configuration exmaple to stop asymmetrical routing as lit leads to performance issues . 

Can we use BGP community or prefix list or some other options to stop asymmetrical routing in the above case.

Many Thanks

[nazimkha]

HI Kumar,

Are you using ACI multipod or multisite for DCI ?

Is the DCI between the ACI a L3OUT ?

[Kumar99]

Hi Nazimkha ,

Thank you for the reply ..
I am not sure how about the cisco ACi config as these managed by 3rd party .

Cisco ACI established ebgp from the leaf switches to nexus 7ks . This is the info I had with me.

Can we use prefix-list or community on nexus 7ks to influence in and out traffic ?

Many Thanks..

[nazimkha]

You can block the BGP advertisement to the ACI fabric using prefix-lists and only advertise via the DCI link between the Nexus 7K. Bear in mind that dynamic routing with BGP is supported only from certain N7K releases.

I would collaborate with the ACI team and design as per Cisco Validated design.

[Kumar99]

Hi if I block bgp advertisement towards Cisco ACI then LAN subnets can not go to Wan n/w and vice-versa..bgp advertisements should not go through DCI link of Cisco ACIs .....Many Thanks

[Abzal]

Basically you should advertise your lan subnets with worse metric toward Cisco ACI. We do that by as-path prepending of your AS number on Nexus7k toward Cisco ACI. Similar action should be done at DC2 Nexus7k. After path over Cisco ACI would be less preferable.

ip prefix-list 100 permit 10.10.10.0/24

ip prefix-list 100 permit 10.10.20.0/24

ip prefix-list 100 permit 10.10.30.0/24

route-map <name of route-map> permit 10

  match ip prefix-list 100

  set as-path prepend <your AS> <your AS> <your AS>

neighbor <Cisco ACI> route-map <name of route-map> out

[bjornarsb]

Hi,

The configuration is not Complete, but it gives you some information of how you can use BGP attributes (as-path and local preference) to avoid asymetric routing.

Datacenter 1

DC1_NX1:

BGP peering interface:
interface loopback 1
 ip address x.x.x.x 255.255.255.255

router bgp 300
neighbor 9.9.9.9 remote-as 500
neighbor 9.9.9.9 description Cisco ACI
neighbor 9.9.9.9 route-map trafic-in in
neighbor 9.9.9.9 route-map trafic-out out
network 10.10.10.0 mask 255.255.255.0
network 10.10.20.0 mask 255.255.255.0
network 10.10.30.0 mask 255.255.255.0

route-map trafic-in permit 100
set metric 0
set local-preference 90

route-map trafic-out permit 1000
set as-path prepend 300 300 

DC1_NX2:

router bgp 300
neighbor 3.3.3.3 remote-as 700
neighbor 3.3.3.3 description DC2-NX1-EBGP
neighbor 3.3.3.3 route-map prefered-path-in in
neighbor 7.7.7.7 remote-as 500
neighbor 7.7.7.7 description Cisco ACI
neighbor 7.7.7.7 route-map trafic-in in
neighbor 7.7.7.7 route-map trafic-out out
network 10.10.10.0 mask 255.255.255.0
network 10.10.20.0 mask 255.255.255.0
network 10.10.30.0 mask 255.255.255.0

route-map trafic-in permit 100
set metric 0
set local-preference 75

route-map trafic-out permit 1000
set as-path prepend 300 300 300 300

route-map prefered-path-in permit 100
set metric 0
set local-preference 100   (100 is default)

Datacenter 2:

DC2_NX1:

router bgp 700
neighbor 4.4.4.4 remote-as 300
neighbor 4.4.4.4 description DC1-NX2-EBGP
neighbor 4.4.4.4 route-map prefered-flow-in in
neighbor 8.8.8.8 remote-as 500
neighbor 8.8.8.8 description Cisco ACI
neighbor 8.8.8.8 route-map trafic-in in
neighbor 8.8.8.8 route-map trafic-out out
network 20.20.10.0 mask 255.255.255.0
network 20.20.20.0 mask 255.255.255.0
network 20.20.30.0 mask 255.255.255.0

route-map trafic-in permit 100
set metric 0
set local-preference 90

route-map trafic-out permit 1000
set as-path prepend 300 300

route-map prefered-flow-in permit 100
set metric 0
set local-preference 100   (100 is default)

DC2_NX2:

router bgp 700
neighbor 6.6.6.6 remote-as 700
neighbor 6.6.6.6 description DC2-NX1-IBGP
neighbor 8.8.8.8 remote-as 500
neighbor 8.8.8.8 description Cisco-ACI-EBGP
neighbor 8.8.8.8 route-map trafic-in in
neighbor 8.8.8.8 route-map trafic-out out
network 20.20.10.0 mask 255.255.255.0
network 20.20.20.0 mask 255.255.255.0
network 20.20.30.0 mask 255.255.255.0

route-map trafic-in permit 100
set metric 0
set local-preference 75

route-map trafic-out permit 1000
set as-path prepend 300 300 300 300

HTH

BR

bjornarsb