Asymmetric BGP return path breaks a stateful firewall
A retail company runs OSPF area 0 across its headquarters and two data centers. Each data center has a pair of Nokia 7750 SR routers running iBGP with each other and eBGP to a different ISP. The routers advertise a default route into OSPF with the same metric, so HQ core routers install two equal-cost defaults. A stateful firewall cluster sits behind the HQ core and is active/standby, with both nodes sharing a VRRP VIP. Since the second ISP link was added, about 5% of outbound TCP sessions to payment providers time out. Captures show SYN packets leaving via ISP-A but return traffic arriving via ISP-B and being dropped by the standby firewall. The company wants to keep both ISP links active for outbound traffic and preserve sub-second failover. No NAT is used for these payment flows.
1. Explain the packet flow that causes the 5% timeouts and why the OSPF equal-cost default route is not the root cause by itself.
Read the worked answer
The SYN from HQ to the payment provider is routed by the HQ core over one of two equal-cost OSPF defaults, say R1/ISP-A, and the stateful firewall creates a session on its active node. The return packet arrives from the payment provider via ISP-B at R2. R2 has no reason to send it to the same firewall node; it forwards toward the VRRP VIP. If the firewall is active/standby, the standby node drops the packet because it does not forward, or because the session is not synchronized for that path. OSPF equal-cost defaults contribute to unpredictable outbound selection but are not the only cause: inbound BGP path selection at the ISPs is independent. The real requirement is per-flow symmetry across the stateful device.
2. Propose a Nokia SR OS configuration strategy that keeps both ISP links active for general traffic but makes payment flows symmetric. Include how you would influence outbound and inbound selection.
Read the worked answer
Identify the payment-provider prefixes and make them a special routing class. Outbound: on R1 and R2, create a BGP policy that sets local-preference 200 for those prefixes via ISP-A and 100 via ISP-B; ensure the OSPF default is not preferred over BGP for those destinations. Inbound: for the company's public /24, advertise a more specific /24 only to ISP-A, or prepend the AS path three times toward ISP-B, so the payment provider returns via ISP-A. Keep general Internet traffic on both links. Align VRRP priority and firewall state sync with R1 so the active firewall sits on the preferred path. Use BFD for fast failure. Because inbound traffic depends on ISP policy, validate with looking-glass and synthetic TCP tests.
3. What would you monitor to confirm the fix, and what fallback would you keep?
Read the worked answer
Monitor firewall session counts per path, NetFlow for the payment prefixes, BGP best-path and advertisements on both border routers, and synthetic TCP handshakes from HQ to each payment provider. A fallback is policy-based routing for the payment prefixes to R1, or an active/active firewall that supports asymmetric flow handling with state synchronization. Keep the fallback documented but do not enable it unless the BGP policy fails.