05-11-2017 10:39 AM
we have from time to time communication problems via SRXdue to asymetric routing, the return traffic does use different way not touching the firewall at all.
I know how to handle that situation (interface nat or static route)
but due to specific cloud solutions we often do neither know sourceaddress, or destination adress or port, so detection is difficult
so my question: is there a specific searchable info in the security log written at session-end which helps us find such flows ? (where typically the return flow has 0 packets or any specific close-state)
thanks in advanc for help
05-12-2017 11:45 AM
There could be 2 scenarios in an asymmetric alow :-
Source A ------ SRX ------- Destination B
1) Traffic from A to B traverses through the SRX. Session would be created, no reply packets would be seen as the replies are taking a different path.
2) A to B does not traverse the SRX, however, the replies from B to A reach the SRX. For TCP traffic, the packets would be dropped saying "First packet not sync".
I do not think that security logs would be helpful to identify this as this can be seen in security flow traceoptions.
Please mark my response as Solution if it Helps, Kudos are Appreciated as well.