OTV with paired stateful firewalls - avoiding asymmetric routing

8c-stone · ‎05-12-2011

Hi,

I cant find a quick answer on this one, but if I deploy OTV in a dual L3 DataCentre deployment, does the return traffic follow the OTV path, or take it's own Routing table next-hop...? I need to extend L2 as an interim measure, prior to application re-development to enable L3 support (well likely more like application team convincing than app redevelopment...) But need to ensure that the return path is same as the incoming, without NAT.

Thanks

mohammedrafiq · ‎05-20-2011

Hi,

Here is my thoughts,

When you configuring OTV between datacenters over Daul WAN links, then you need to use sepreate WAN device or create WAN VDC.so do you care which one is the return path there, its only matter when it enters into your LAN Nexus or LAN VDC(where your FW will be connected) through site local VLAN.Now here you can configure multiple links between LAN and WAN device or VDC's as portchannel in vPC to keep your traffic symmerical.

Hope its make sense.

Regards,

8c-stone · ‎05-23-2011

Thanks for the reply. I dont think that it does answer my question, however I have now read an article on OTV with LISP which I believe answers it entirely...

I now need to find out if LISP is supported in current NX-OS.

Thanks, Carl

pvinci · ‎08-10-2012

LISP is supported and licensed along with OTV on the N7K.

With OTV, you use FHRP filtering to address the egress traffic and then you can use LISP to address the ingress traffic. Otherwise, you will experience the classical "trombone routing" associated with stretched vlans.

If you have any questions, let me know.

Regards,

Paul

http://vinciconsulting.com/vxnet