Cisco OTV/LISP for East to West VM Migrations and Checkpoint TCP Stateful Inspection

[Peter-L]

Hello,

We're currently in the process of implementing Cisco OTV/LISP on Nexus 7k devices and ISR 4431's to ensure that traffic follows are symmetric. LISP ensures that traffic destined for the stretched L2 ingresses and egresses on the same site, eliminating asymmetric routing.



Additional Info: http://yves-louis.com/DCI/?p=785

However as we are talking about a live migration of a production VM (east to west) and LISP will resolve the routing issue there is a further knock on issue of the TCP connection state table not being synchronized between the East and West DC's. Has anyone here any experience of this?

Right now the only solution I can see is to switch my 2x active/passive clusters to be active/active and cluster across the DC's to ensure the connection state table is synchronized.

Anyone else any suggestions (aside from turning off state inspection)?

Thanks,
Peter

[Iron Man]

Hello,

We're currently in the process of implementing Cisco OTV/LISP on Nexus 7k devices and ISR 4431's to ensure that traffic follows are symmetric. LISP ensures that traffic destined for the stretched L2 ingresses and egresses on the same site, eliminating asymmetric routing.



Additional Info: http://yves-louis.com/DCI/?p=785

However as we are talking about a live migration of a production VM (east to west) and LISP will resolve the routing issue there is a further knock on issue of the TCP connection state table not being synchronized between the East and West DC's. Has anyone here any experience of this?

Right now the only solution I can see is to switch my 2x active/passive clusters to be active/active and cluster across the DC's to ensure the connection state table is synchronized.

Anyone else any suggestions (aside from turning off state inspection)?

Thanks,
Peter

Hi Peter,
I'm currently facing the same challenge where i'm planning to use Cisco OTV for my data center Interconnection, but i've not found a solution yet for for the stateful inspection on my two Checkpoint clusters that are currently working Active/standby on each site. Did you finally opt for the 4 node clusters?

Herold