Summary
Each shard publishes its masquerade address, but as an EVPN path into the router mesh. The transit carries plain IPv6 unicast and never learns it, so a reply from anything outside the fabric is routed by the transit's default route and discarded.
Verified end to end against a host outside the fabric: a tenant's request arrived there with the correct translated source and port, the host answered, and the transit had no route at all for the address it was answering to. Every masqueraded flow is one-way today. The ingress VIP has the same shape of problem and is worked around by originating a covering aggregate into the underlay from the edge nodes; the shards do nothing equivalent.
Outcome
A reply from outside the fabric, addressed to a shard's masquerade address, reaches that shard.
Related to #409, which asks where such an address should come from. This is that a correctly configured one is still unreachable.
Summary
Each shard publishes its masquerade address, but as an EVPN path into the router mesh. The transit carries plain IPv6 unicast and never learns it, so a reply from anything outside the fabric is routed by the transit's default route and discarded.
Verified end to end against a host outside the fabric: a tenant's request arrived there with the correct translated source and port, the host answered, and the transit had no route at all for the address it was answering to. Every masqueraded flow is one-way today. The ingress VIP has the same shape of problem and is worked around by originating a covering aggregate into the underlay from the edge nodes; the shards do nothing equivalent.
Outcome
A reply from outside the fabric, addressed to a shard's masquerade address, reaches that shard.
Related to #409, which asks where such an address should come from. This is that a correctly configured one is still unreachable.