Transit Gateway ECMP Flow Aware

0

Is a Transit Gateway, configured with ECMP and multiple VPNs advertising the same CIDR range, flow aware to prevent asynchronous routing?

AWS
MikeLap
질문됨 5년 전727회 조회
1개 답변
0
수락된 답변

Flow-awareness is something from MPLS, not from standard IP routing. But I think I know what you mean:

The way that ECMP works is that a node distributes the traffic across the multiple path based on an algorithm. The two common ones are:

  • 3-tuple: the protocol number in the IP header (i.e., TCP, UDP, ICMP, …) and the IP source and destination addresses
  • 5-tuple: the protocol number, the IP addresses and the TCP or UDP source and destination port numbers

In the case here, the TGW will look at packets destined to the VPN ECMP and based on 5-tuple hash that packet to one of the path. Similarly the CGW/CPE will perform hashing on the packets destined for the TGW.
With this the response might not traverse the same path as a request. You will end up with asymmetric routing. That's perfectly fine as IP routing is stateless.

The problem starts if your VPN terminates on a stateful firewall and not a router. A stateful firewall will often be configured to allow established and related connections. For this to work, you must assure, that the firewall can "see" the "new" connection part as well as the "established" connection part. As written above with ECMP that's not the case.

profile pictureAWS
전문가
답변함 5년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠