Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
01-06-2021 11:04 PM
We have two on-prem data centers connected with dual L3 EVC links between them on our core switches and we are using OSPF for routing. We also have PA firewalls deployed in each location and we are extending OSPF up to them. We are then connected to Azure over each of the PAs over an IPSEC VPN and using BGP and injecting the OSPF routes.
If I disable one of the IPSec tunnels, everything works perfectly.
The issue we are having is that Azure is sending return traffic back to the wrong data center location when both IPSec tunnels are up, then of course the firewall is dropping the traffic.
What is the best way with BGP to have the backup routes available, but make sure the traffic to each data center is for the local subnets in that data center.
For instance:
Data Center 1 - 192.168.30.0/24
Data Center 2 - 10.128.0.0/24
Azure - 10.140.0.0/16
I need to make sure that the VPN from Azure to DC1 has a route to 192.168.30.0/24 and 10.128.0.0/24 but the 10.128.0.0/24 should only be a backup route and should send the traffic to DC2 if that route is available.
Azure should send traffic to 10.128.0.0/24 to DC2 when that IPSec tunnel is up with a backup route to 192.168.30.0/24.
What is the process with BGP to force the route(s) that I'm advertising from DC1, which should be a backup route to DC2, to force it to be a backup route to stop the asymmetrical routing?
