Local Egress will ensure site specific routes are send via respective Site ESG ( SITE A ESG OR SITE B ) for optimal routing. Technically you can certainly filter routes at any layer (NSX or physical network) , it depends upon the use case. We can filter at ESG,TOR- BGP path prepend are few options for ingress traffic . This is something that we have to consider for A-A and A-P sites and GSLB would be a great option when we have apps spanned across multiple sites. Remember in Active-Active model DC we always expect ingress/egress at the data center local to the client
You should certainly read below articles
Asymmetric routes are expected when ESG's are in ECMP pairs. To prevent that ESG firewall will be disabled and stateful services are allowed to run on ESG. DFW rules are preferred in that case
Thanks a lot for your response.
But for the Universal Locical Switches that are attached to both the UDLR on Site A and UDLR on Site B the UDLR's will publish the route for this segment to ESGs on Site A and Site B. So in an active-active environment there is no way of controlling on the UDLR if Site A or Site B is the entry point for ingress traffic. So there is the possibility of asymmetric routing even with only one ESG per site. Thats also why the feature is called "local egress"...
As pointed on the prevous post, symmetrical traffic is needed for performance and if there is firewall on the ESG. This could be achieved in 2 ways:
1. Using NAT on ESG for the VM and using Global Load Balancer. If Nat pools are kept on seperate subnets, the ingress and egress woiuld be symmetrical. This needs the GLB to understand on which side the Application servers reside and change the dns replies dynamically. If there is no server for App-A on Site-2, it should stop site-2 replies.
2. If NAT is not used, UDLR could understand on which site a VM exists from the arp table, and start to announce this specific /32 host route towards ESG, which in turn announces this route to physical Wan cloud. Thus clients ingress and egress is always symmetrical. If there are 2 vMs with Ips VM-1 10.10.10.10/24 on site-1, and VM-2 10.10.10.20/24 on site-2 ingress and egress is symmetrical, and if VM-1 goes to site-2, the ingress traffic towards VM-1 changes to Site-2. GLB again could distribute the load betweeb sites according to number of App servers for different sites.
For active-standby scenarios GLB could not be needed.