Hi Folks,
I may be missing something here but want to verify. If a /24 (ASN789) is announced out two ISPs say IPS1 (ASN123) and IPS2 (ASN456). With rp-filter set to loose is there a reason that some websites would not work when using https, and having no state full firewall on my side? Is this breaking on the remove side due to asymmetric routing?
If it matters one peer is direct, and the other is over a GRE tunnel.
Thanks!
GRE tunnel - yes, maybe if the GRE tunnel causes fragmentation.
BGP and asymmetric routes - no, it should not break.
Yeah, I am at a loss on it. My assumption at this point is it has something to do with the GRE tunnel. If I remove announcement from peer 2 and local pref peer 1 all works fine with announce, and routing out of a single ASN. Really odd.
I’d look at both possible paths MTU. Just being asymmetrical isn’t a deal breaker. I’d expect the GRE tunnel to have a lower MTU. If you or anywhere along the path either misconfigured the MTU or are blocking ICMP too big messages you will see issues. This is especially prevalent with protocols like HTTPS that set the DF or don’t fragment bit in IPv4. Often it will feel like your setup is mostly working. You can test with ping CLI commands for both IPv4 and IPv6 (I know you mentioned a /24 which is probably IPv4).