if there was such a thing as a CCI level equivalent lab exam where as your network in then this diagram and the problem it manifests could be one of the scenarios on that test if you look at this diagram here can you see a possible problem the answer is probably no because you have to dig into the details understand why so let's do that now because it's kind of interesting and it highlights the value of road maps which is a feature in public preview for VW if you have this problem then you can be aware of the fix we'll also talk through some of the other fixes and workarounds to the problem let's first of all explain the problem so we've got a virtual one here in blue with three hubs so Global virtual W these hubs here are in Europe this is kind of a Satellite Hub different area of the world let's say us for example let's say the customers migrate into this then over here on the left hand side in red we got a legacy environment for the customer based on regular hsbk environment which they're migrating away from with a regular existing virtual Network Gateway Express rout Gateway there and they have Express rout circuits just drawn them as one blob here at the moment and they have on Prem down there and as that's common uh pattern we see for a period of time when you've got spokes over here and spokes over here we Leverage The Express root hair pin to facilitate the transport between the two environments uh obviously we should keep that period of time as short as possible we shouldn't be relying on equipment in the edge Network to rout in Azure but sometimes needs must and let's say we acknowledged that risk and requirement to make this migration as soon as possible sometimes that's protracted sometimes you need this flow for a longer period of time in our V here we've got a global V three hubs routin intent everywhere firewalls everywhere so all traffic goes through all firewalls got inter region routin etc etc now in this diagram the problem we have is let's say we have a spoke over here trying to communicate to this spoke over here hanging off our satellite us Hub traffic leaves this Gateway goes to our circuit the circuit then has to make a decision how do I get to this prefix well the prefix is learned from both fan hubs and the metrics are identical prefix length same A's path the same so the circuit can use either this path or this path let's say a particular flow goes across the top path to this V Hub into the gateway through the firewall across inter Hub transport through the firewall down into the spoke let's do the return path in Orange the spoke then has to return the traffic well it's using routing intent so it knows nothing apart from send it to my local firewall that firewall then says how do I get back to this spoke over here and that's where our problem rears its head because VW has kind of got the same challenge like do I go to the top or do I go to the bottom I'm learning the root from my sort of remote Express rout gateways and the roote looks the same The Roots just coming from here and VW will pick one of those paths it will pick this path perhaps so you see now we've got an aimet Tre we've got traffic coming in Via purple on firewall a and leaving our orange via firewall B whether that's NVA or an an Azure firewall those firewalls won't like that they're going to drop the traffic it's a state for firewalling only see one side of the conversation so we have a problem we have traffic flows not working due to asymmetry so if we need this pattern how do we fix it well if it was on Prem we have more options because we have contr the air path Etc but because it's coming from an Azure vng and because it's coming from a common circuit we have limited ability to control the path let me show you the problem in a bit more detail if we dive into the circuit if I go to this circuit here and I look at the effective Roots this is my spoke hanging off my V Hub in the US and you can see my circuit it's got four paths to it two via the top V1 Hub two via the bottom V1 Hub which is representing the problem we talked about it knows about it in both directions when I look at the effective roots on Azure firewall inside of the B1 Hub C and I look for the other spoke in the other region we see that there's only one path back for that prefix and it's via one single Hub and this is the as path so this is V1 inter Hub 65520 and then 1276 is representing the express root Transit so this is just another way of saying we've got a symmetry from top to bottom how can we solve it well rout Maps is the best way to fix this if we want the most resilient design of course one way of fixing it is just to disconnect our circuit from the top hop thereby we've only got one way in one way out but then we have a lack of resilience we have to reconnect this circuit in a Dr event now if we use rout Maps which like I say are in preview we have the ability to on these hubs set certain bgp level and lay three routing level configuration we can look at Roots when they come in based on their subnet Mass communities as path and then set summarization and set preens so what I've done here is in my rout Maps maybe I'll just switch to a split screen view to show you this better so here I am looking at my top virtual manhub the one the top path is the one we do not want to use we want to make the path symmetrical from v1c both in and out via the bottom Hub and to do that we're going to use prepend and these are my route Maps so I've got the top route map for outbound and then another route map for inbound and if we look at the route Maps so my in statement matches the vet over here so when the route matches this prepend additional values additional as paths when the route propagates into V1 so that's the purple path here so when that when this route comes in this way add a plus three prepend when the route leaks across Vian INB and into other parts of V1 which will mean the bottom path is preferred and then my other route map the outbound route map is taking this route which is my prefix associated with the green one over there it's saying whenever this leaves VW prepend and I've got that Associated both of those route Maps Associated to my Express rout connection here and when I've done that you can see it's had an impact on our circuit level routing information you can see I've now got still four routs but two of those have got a longer as path and those are the two that are coming from these next hops which are my top Hub so the of applying those rout maps to that connection means that when my circuit chooses how to get to my V remote spoke it's going to pick either this one or this one which both go to the bottom Hub similarly when I look over here at my Azure firewall config at the effective Roots I know that the top path will not be used because the bottom path is preferred due to a shorter a path now it's a bit different when you look in the effective routs for a asure firewall in V1 because you're seeing effectively the effective Roots which are taking place you're not seeing the entire bgp rooting table like you are with the express rout circuit there so we only see the one effective route saying it always goes to the bottom Hub but just to show that the as path does propagate across into Hub I flip flip the prepend and you can see that you can indeed influence and add your own preens I did plus one in this case and this diagram is just again talking through what we said that the overall logic when we apply this config is we always end up sending our traffic to v1b when it goes this way and V1 C always returns the traffic this way could there be other ways of fixing this yes but um I would say once R mats a ga then M will be the preferred solution as we said you could just disconnect this circuit you could do complex Solutions where you snat uh on the firewalls in both directions but of course that's going to impact how on Prem sees your traffic and again just to reiterate that the longer term goal here is to get any spokes here that are attached to the old world get them attached to the new world and the problem goes away uh there are some other Solutions you could look at here which would be V1 C could be directly connected to your Express rout circuit so you could have an Express rout Gateway here and then you have no problem with traffic coming in here and here because traffic always comes in here and always goes out here due to the local route being preferred but in our case if this is in the US and this is in Europe you would need to upgrade that circuit to premium and that's obviously got a cost implication anyway that was just a quick informal Tech video showing how rout Maps will help you with some scenarios in Azure the route maps of course will be useful for on Prem routine and other scenarios in the future but thanks for watching and I'll catch you soon