“A misconfigured BGP route-map redistributed an overlay route back into the physical underlay core, creating an asymmetric routing loop that dropped 50% of cloud traffic.”

At IBM, designing Tier-0 Edge Gateway routing required strict controls to prevent Transitive Routing Loops between NSX overlay logical routers and physical BGP core switches.

The Asymmetric Routing Pitfall

When multi-homed Tier-0 Edge Nodes peer with physical switches:

1. Tier-0 Gateway A advertises prefix 10.100.0.0/16 to Physical Core A over BGP.
2. Physical Core A redistributes the route to Physical Core B.
3. Physical Core B advertises the route back to Tier-0 Gateway B.
4. The Loop: Traffic enters Gateway A but attempts to return via Core B, triggering firewall state drops.

[!IMPORTANT] Apply strict BGP AS-Path Prepending or BGP Community Tags on outbound Tier-0 routes to prevent physical underlay networks from re-advertising routes back into the SDN overlay.

# # BGP Community Route-Map to Prevent Transitive Redistribution
route-map NO_TRANSITIVE_RE-ADVERTISE permit 10
 match community 65000:100
 set no-advertise

The Verdict

Key Takeaway

Tag and Filter All Cross-Boundary BGP Routes.

Never redistribute routes between overlay SDN routers and physical core networks without applying explicit BGP community tags or route filters.