Configure remote access traffic symmetry at Cisco Catalyst SD-WAN sites with multiple Cisco IOS XE Catalyst SD-WAN devices acting as SD-WAN RA headends to ensure return traffic is correctly routed to remote access clients.
This task ensures remote access traffic symmetry (both directions of a flow using the same path) to enable return traffic to be correctly routed to remote access clients.
At Cisco Catalyst SD-WAN sites with multiple Cisco IOS XE Catalyst SD-WAN devices acting as SD-WAN RA headends, traffic symmetry configuration is required to prevent routing issues.
Procedure
-
Configure remote access traffic symmetry for sites that use VRRP.
At a site with multiple Cisco IOS XE Catalyst SD-WAN devices functioning as SD-WAN RA headends, and with a LAN that uses the virtual router redundancy protocol (VRRP), use this procedure to ensure remote access traffic symmetry and return traffic reachability.
Figure 1. Site with Service-Side VRRP 
-
Ensure that each SD-WAN RA headend has a unique local private IP pool (remote access IP pool) for assigning IP addresses to remote access clients. remote access clients use the assigned private IP as the source IP for all inner (within the IPsec tunnel) traffic.
-
On each SD-WAN RA headend, in each of the end user service VPNs, add a static route to the remote access IP pool of each of the neighbor SD-WAN RA headends. For the static route, configure the corresponding SD-WAN RA headend as the next hop.
The effect of this step is that if there is an asymmetric traffic flow, where return traffic arrives at a different device at the site than forward traffic, the static route forwards the traffic to the correct SD-WAN RA headend device, which is the headend device with the IPsec tunnel and host route to the remote access client.
Example:
In the example shown in the figure, there are two SD-WAN RA headend devices (SDRA-1 and SDRA-2) at the same site. They are interconnected with a service VPN. Each has a unique local IP pool.
-
On SDRA-1, configure a static route as follows:
-
Route destination: SDRA-2 IP pool subnet
-
Route next-hop: SDRA-2 service VPN IP
-
-
On SDRA-2, configure a static route as follows:
-
Route destination: SDRA-1 IP pool subnet
-
Route next-hop: SDRA-1 service VPN IP
-
-
-
Configure remote access traffic symmetry for sites that use routing protocols.
At a site with multiple Cisco IOS XE Catalyst SD-WAN devices functioning as SD-WAN RA headends, and with a LAN that uses routing protocols such as open shortest path first (OSPF) or enhanced interior gateway routing protocol (EIGRP), use this procedure to ensure remote access traffic symmetry and return traffic reachability.
Figure 2. Site with Service-Side routing protocol 
-
Ensure that each SD-WAN RA headend has a unique local private IP pool for assigning IP addresses to remote access clients (remote access IP pool). remote access clients use the assigned private IP as the source IP for all inner (within the IPsec tunnel) traffic.
-
On each SD-WAN RA headend, redistribute the remote access IP pool into the service side routing protocol, so that the LAN-side router/L3 switch forwards any return traffic destined to remote access clients to the correct device, based on the assigned IP address (return traffic destination IP).
-
Remote access traffic symmetry is configured, ensuring that return traffic is correctly routed to remote access clients at sites with multiple SD-WAN RA headends.