MLAG ISC VRRP asymmetric routing possible

[Justin_Metts]

We are having a problem with the ISC between two x460s. VRRP is configured as ACTIVE/STANDBY. Everything looked fine initially during our tests as we only used ICMP. I configured separate "external" switches with IPs I could ping to test MLAG fail over on access switches connected to the two x460 core switches. The test dropped pings as expected and VRRP transitioned properly on failover. MLAG worked as well going to the access switches. Now the problem. TCP and UDP traffic does not establish any kind of connection. We connected the 460s to the internet and were able to ping 8.8.8.8, but cannot telnet to 53 nor http ports. Needless to say, no internet. When I disconnect the ISC between the two 460's, internet works flawlessly. I have no idea why this is and have not opened a ticket yet. I was plugged into the active VRRP switch when I tested, so the traffic shouldn't have been affected by the ISC in the first place. VRRP is balanced on the switches, half ACTIVE and half STANDBY. I figure if I change the configuration to ACTIVE/ACTIVE, then the traffic would flow correctly. I have followed the Extreme guides to configure the ISC and MLAG as well. That is how the switches are configured. Link that is similar to ours. Instead of the server, we have access switches. https://d2r1vs3d9006ap.cloudfront.net/s3_images/1108985/RackMultipart20141015-13973-hmz4ni-L3MLAG.png?1413378047 This image showed the traffic flowing over the ISC and I would not think this would be an issue.

[BrandonC]

What version of EXOS are the X460s running?

If it is 15.6 or higher, it might be worth running the MLAG config check script found here. This will check that the VLANs on the MLAG ports are also added to the ISC.

[Justin_Metts]

* Slot-1 # run script mlag_config_check.py Local and remote FDB checksums match. MLAG config check completed. Same results on both switches. Posting a better diagram and the configs.

[Justin_Metts]

16.1. I'll try the script tomorrow and also get the configs. I will post what I find.

[Frank]

Hi,

Can you ping (both if applicable) firewalls' internal (vlan3) IP addresses from the workstation in vlan20? With and without the ISC?

If I understand correctly, the VLAN 20 PC is connected to an access switch, which is MLAGed to both 460s. "Switch Inside 1" and "..2", are they MLAGed to both 460s as well?

And just to be sure, both firewalls have the appropriate route back to the vlan20 IP space with the gateway address of the vlan3 VRRP address that's on the 460?

Frank

[Justin_Metts]

I have isolated the switches from the entire network. Only the two switches are connected.