VXLAN - Reverse path check whet traffic passes DCs

[vasilisgogos]

Hello Team,

i have configured VXLAN over VPN  with MP-BGP EVPN

VLANs that are part of VXLAN have VRRP enabled .

VXLAN  and VRRP are working as expected

The problem is when traffic is traversing the DCs (From the Secondary DC to the Primary DC - VRRP-wise) ,

At the destination DC, the traffic is not returning as there is no routing pointing to VXLAN for the return traffic.

There is BGP between DC and the network that is trying to reach the VXLAN IP, which is advertised over the IPSEC.

The strange thing is that when i runed POC on FG 7.4.7 it was working.

attached the config:

[vasilisgogos]

DC2:

edit "vlan598-strech"
set vdom "DMZ"
set member "VlanID598" "vxlan.598"
next
end
config system interface
edit "naf.DMZ"
set vdom "DMZ"
set type tunnel
set src-check disable
set snmp-index 50
next
edit "l2t.DMZ"
set vdom "DMZ"
set type tunnel
set snmp-index 51
next
edit "ssl.DMZ"
set vdom "DMZ"
set type tunnel
set alias "SSL VPN interface"
set snmp-index 52
next

edit "DMZ-Loopback"
set vdom "DMZ"
set ip 172.22.0.1 255.255.255.255
set allowaccess ping
set type loopback
set alias "BGP_Loopback"
set role lan
set snmp-index 198
set ip-managed-by-fortiipam disable
next
edit "Vlan501- DMZ"
set vdom "DMZ"
set ip 172.21.1.4 255.255.255.248
set allowaccess ping speed-test
set type emac-vlan
set role lan
set snmp-index 110
set ip-managed-by-fortiipam disable
set interface "Vlan501"
next
edit "DCI_IPSEC_DMZ"
set vdom "DMZ"
set type tunnel
set snmp-index 121
next
edit "VlanID598"
set vdom "DMZ"
set alias "DMZ Test VLAN"
set role lan
set snmp-index 122
set interface "Middle-Earth"
set vlanid 598
next
edit "vxlan.598"
set vdom "DMZ"
set type vxlan
set snmp-index 123
set interface "DMZ-Loopback"
next
edit "vlan598-strech"
set vdom "DMZ"
set ip 172.21.254.3 255.255.255.0
set allowaccess ping
set type switch
set alias "DMZ Test VLAN"
set device-identification enable
set lldp-transmission enable
set vrrp-virtual-mac enable
config vrrp
edit 1
set version 3
set vrgrp 509
set vrip 172.21.254.1
set vrdst 172.21.254.2
next
end
set role lan
set snmp-index 124
set ip-managed-by-fortiipam disable
next
edit "test_vlan"
set vdom "DMZ"
set ip 1.2.3.1 255.255.255.252
set allowaccess ping
set device-identification enable
set role lan
set snmp-index 125
set ip-managed-by-fortiipam disable
set interface "Middle-Earth"
set vlanid 1234
next
end
config system admin
end
config system zone
edit "DCI_VXLAN_ZONE"
set interface "DCI_IPSEC_DMZ"
next
edit "DMZ Test VLAN"
set interface "vlan598-strech"
next
end
config system sdwan
set status enable
config zone
edit "virtual-wan-link"
next
edit "DCI_ZONE"
next
end
config members
edit 1
set interface "Vlan501- DMZ"
set zone "DCI_ZONE"
set gateway 172.21.1.3
next
edit 2
set interface "Vlan502-DMZ"
set zone "DCI_ZONE"
set gateway 172.21.1.11
next
edit 3
set interface "Vlan503-DMZ"
set zone "DCI_ZONE"
set gateway 172.21.1.19
next
edit 4
set interface "Vlan504-DMZ"
set zone "DCI_ZONE"
set gateway 172.21.1.27
next
edit 5
set interface "Vlan505-DMZ"
set zone "DCI_ZONE"
set gateway 172.21.1.35
next
end
config health-check
edit "DCI_SLA"
set server "172.20.0.1"
set update-static-route disable
set members 1 2 3 4 5
config sla
edit 1
set link-cost-factor latency packet-loss
set latency-threshold 200
set packetloss-threshold 5
next
end
next
end
end
config vpn ipsec phase1-interface
edit "DCI-1_IPSEC"
set interface "Vlan501- DMZ"
set ike-version 2
set keylife 28800
set peertype any
set net-device disable
set exchange-interface-ip enable
set exchange-ip-addr4 172.22.0.1
set aggregate-member enable
set proposal aes256-sha256
set dpd on-idle
set dhgrp 14
set remote-gw 172.21.1.3
set psksecret ENC 1331uPjF3nZ3jKIsEFdFJENmnpDSskBvXpUsIhZP4gfrhK4U+qAo3R3q+oyrPxpih4RYsXZOchxfIqI6e1FhfbH62I1oE9BdGl8+5hCTLxp/6fsrUuwQ2GdFXFGxJbuqHhyOMGo2sdNhvWuoQRNOcKBH50psQW4YAJps0nqCpHJ2c9/FkBWH8N4jcoggZEutDr5bPHe/nllmMjY3dkVA
next
edit "DCI-2_IPSEC"
set interface "Vlan502-DMZ"
set ike-version 2
set keylife 28800
set peertype any
set net-device disable
set exchange-interface-ip enable
set exchange-ip-addr4 172.22.0.1
set aggregate-member enable
set proposal aes256-sha256
set dpd on-idle
set dhgrp 14
set remote-gw 172.21.1.11
set psksecret ENC 1233l9O79X4UGnByd0xUuTf7Sy9p6a+Bk312NAXWuZh/JX7joAvD7258r25jORrYz9bey1YMrL7XxF3RCPRP9KedDZ56zn7qvUxSfrbK0EO6F5ubyRrvLPcJIEf6JgvKxSN8knk2Em/pEFCFzI/RqFsaoKR5caM0LzTFqoI7uYFy8cU73LnFAT8HpIGb9JMvp3MqQIcUmllmMjY3dkVA
next
edit "DCI-3_IPSEC"
set interface "Vlan503-DMZ"
set ike-version 2
set keylife 28800
set peertype any
set net-device disable
set exchange-interface-ip enable
set exchange-ip-addr4 172.22.0.1
set aggregate-member enable
set proposal aes256-sha256
set dpd on-idle
set dhgrp 14
set remote-gw 172.21.1.19
set psksecret ENC 13113D+sZx1ZsdkTyYLQ13143W2+FRt13UDPf9NSneuRSFov97F2CECXS2Pt66BabUovyw6ARrRLG21v8pKxoZ0/W7Gg0NNGrT/zSg3LmpnT1d1Hi9wUo4MTBN6p0ypFCmMmMeYd124SkBpbP9/R+UNtGCqJ+6xPUx11TpNhJ4vqhgXERR1x7LC19Jn8Ye6ZqNm/3R2mrFq9jbtFlmMjY3dkVA
next
edit "DCI-4_IPSEC"
set interface "Vlan504-DMZ"
set ike-version 2
set keylife 28800
set peertype any
set net-device disable
set exchange-interface-ip enable
set exchange-ip-addr4 172.22.0.1
set aggregate-member enable
set proposal aes256-sha256
set dpd on-idle
set dhgrp 14
set remote-gw 172.21.1.27
set psksecret ENC FgnPGpkWaACzKpy3+pl133rM3r/8mn269131ks72ev9roZ8AZJsMhWeQPRK53TTKD1B9DA2vK7jEkV/NtDD6Y7jVyEUJAEGWnE/MknV0XOK5NQnFf1EjHAXAgQAwebXpVoXXfvkJOmuQPjQNutZ7MJE+/3QlJfCv3SyXxKGe5GUzS0Z+y9XzrYyGGBDkaR4Xl+ogNHsvLmPFlmMjY3dkVA
next
edit "DCI-5_IPSEC"
set interface "Vlan505-DMZ"
set ike-version 2
set keylife 28800
set peertype any
set net-device disable
set exchange-interface-ip enable
set exchange-ip-addr4 172.22.0.1
set aggregate-member enable
set proposal aes256-sha256
set dpd on-idle
set dhgrp 14
set remote-gw 172.21.1.35
set psksecret ENC t/zFITiL26MdMtDTeW131LepL/sMu1313UZP4/fgA6aNATZssHduDN+XQQNlWmnji7x36EmNi9B12oeJfwrsvAn3OCreFvzCB/1uvpz+IUaqCG9ilNjVvNU9qlKlzxsvNsfeA8EOLPEn+BTepraW/sr3Or7eFYiNi3YefTJCaTNgyD8VtfMQc/5uF46N1K6uHyx0j7gfheu61lmMjY3dkVA
next
end
config vpn ipsec phase2-interface
edit "DCI-1_IPSEC.p2"
set phase1name "DCI-1_IPSEC"
set proposal aes256-sha256
set dhgrp 14
set auto-negotiate enable
set keylifeseconds 3600
next
edit "DCI-2_IPSEC.p2"
set phase1name "DCI-2_IPSEC"
set proposal aes256-sha256
set dhgrp 14
set auto-negotiate enable
set keylifeseconds 3600
next
edit "DCI-3_IPSEC.p2"
set phase1name "DCI-3_IPSEC"
set proposal aes256-sha256
set dhgrp 14
set auto-negotiate enable
set keylifeseconds 3600
next
edit "DCI-4_IPSEC.p2"
set phase1name "DCI-4_IPSEC"
set proposal aes256-sha256
set dhgrp 14
set auto-negotiate enable
set keylifeseconds 3600
next
edit "DCI-5_IPSEC.p2"
set phase1name "DCI-5_IPSEC"
set proposal aes256-sha256
set dhgrp 14
set auto-negotiate enable
set keylifeseconds 3600
next
end
config system evpn
edit 598
set rd "598:598"
set import-rt "598:598"
set export-rt "598:598"
set ip-local-learning enable
set arp-suppression enable
next
end

config system ipsec-aggregate
edit "DCI_IPSEC_DMZ"
set member "DCI-1_IPSEC"
set algorithm weighted-round-robin
next
end
config system vxlan
edit "vxlan.598"
set interface "DMZ-Loopback"
set vni 598
set evpn-id 598
next
end

config router prefix-list
edit "advertised.vxlan.dmz.subnets"
config rule
edit 1
set prefix 1.2.3.0 255.255.255.252
unset ge
unset le
next
end
next
end
config router route-map
edit "deny_any"
config rule
edit 1
set action deny
unset set-ip-prefsrc
next
end
next
edit "advertise.vxlan.dmz.route-map"
config rule
edit 1
set match-ip-address "advertised.vxlan.dmz.subnets"
unset set-ip-prefsrc
next
end
next
end
config router rip
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "ospf"
end
config redistribute "bgp"
end
config redistribute "isis"
end
end
config router ripng
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "ospf"
end
config redistribute "bgp"
end
config redistribute "isis"
end
end
config router ospf
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "rip"
end
config redistribute "bgp"
end
config redistribute "isis"
end
end
config router ospf6
config redistribute "connected"
end
config redistribute "static"
end
config redistribute "rip"
end
config redistribute "bgp"
end
config redistribute "isis"
end
end
config router bgp
set as 65000
set ebgp-multipath enable
set ibgp-multipath enable
set network-import-check disable
set additional-path enable
set graceful-restart enable
set additional-path-select 4
config neighbor
edit "172.20.0.1"
set ebgp-enforce-multihop enable
set next-hop-self enable
set next-hop-self-vpnv4 enable
set soft-reconfiguration enable
set soft-reconfiguration-vpnv4 enable
set soft-reconfiguration-evpn enable
set interface "DCI_IPSEC_DMZ"
set remote-as 65000
set route-map-out "advertise.vxlan.dmz.route-map"
set keep-alive-timer 10
set holdtime-timer 30
set update-source "DMZ-Loopback"
set route-reflector-client enable
set route-reflector-client-evpn enable
next
end
config network
edit 60
set prefix 1.2.3.0 255.255.255.252
next
end
config redistribute "connected"
end
config redistribute "rip"
end
config redistribute "ospf"
end
config redistribute "static"
end
config redistribute "isis"
end
config redistribute6 "connected"
end
config redistribute6 "rip"
end
config redistribute6 "ospf"
end
config redistribute6 "static"
end
config redistribute6 "isis"
end
end
config router isis
config redistribute "connected"
end
config redistribute "rip"
end
config redistribute "ospf"
end
config redistribute "bgp"
end
config redistribute "static"
end
config redistribute6 "connected"
end
config redistribute6 "rip"
end
config redistribute6 "ospf"
end
config redistribute6 "bgp"
end
config redistribute6 "static"
end
end
config router multicast
end

[vasilisgogos · Accepted solution]

Solution found by myself.

If presenting VXLAN as possible  destination (over bgp) it works .