Cisco SD-WAN 800v BGP peering with VWAN hub

Imroz Khan 0 Reputation points
2023-10-01T05:00:18.8+00:00

Hi,

I have 2 regions of Azure connected to each other via Azure VWAN hub. Also we have Azure express route from each Azure region landing into the on-prem DC.

We intend to manually deploy 2 x Cisco SD-WAN 8000v routers in each region and setup BGP peering with respective vhubs.

I wanted to know as part of BGP advertisement the 8000v routers will send BGP extended community Site-of-orignal (SOO) to the vhub. Will the vHub accept the extended community as part of BGP advertisement and send it to the on-prem routers within the BGP updates over the Express route links. We intend to use these community to enable routing loop prevention mechanism in the on-prem DC.    

Azure Virtual WAN
Azure Virtual WAN
An Azure virtual networking service that provides optimized and automated branch-to-branch connectivity.
190 questions
{count} votes

1 answer

Sort by: Most helpful
  1. KapilAnanth-MSFT 36,396 Reputation points Microsoft Employee
    2023-10-25T06:06:58.9533333+00:00

    @Imroz Khan

    Greetings.

    Wrt, "can you advise if I configure my NVA's as Active-Active, how will the vhub understand that, and in case if it receives traffic from NVA-1, how to make sure the vhub will only forward the traffic to the required destination vnet and not send it back to NVA-2, which could be a routing issue."

    • Azure platform doesn’t guarantee symmetry - a single flow can have inbound come on instance0 and outbound return on instance1.  
    • For scenarios where the two NVA instances are advertising the same route with the same priority,
      • Make sure stateful inspection on the NVA or related firewalls is turned off or
        • Asymmetric forwarding is turned on. 
           
          
    • If stateful firewall is required consider active-passive set ups or having one nva instance advertise a route of higher priority for active-active purposes. 
      • i.e., you still get high availability but one NVA instance is preferred over the other unless this instance becomes unavailable.

    Hope this helps.

    Cheers,

    Kapil


    Please Accept an answer if correct.

    Original posters help the community find answers faster by identifying the correct answer.

    0 comments No comments