SRX Services Gateway
Showing results for 
Search instead for 
Do you mean 
Reply
Highlighted
Super Contributor
Posts: 124
Registered: ‎12-10-2013
0 Kudos

HOW IS ASYMMETRIC ROUTING reflected in log session-end message

we have from time to time communication problems via SRXdue to asymetric routing, the return traffic does use different way not touching the firewall at all.

I know how to handle that situation (interface nat or static route)

 

but due to specific cloud solutions we often do neither know sourceaddress, or destination adress or port, so detection is difficult

 

so my question: is there a specific searchable info in the security log written at session-end which helps us find such flows ? (where typically the return flow has 0 packets or any specific close-state)

 

thanks in advanc for help

Alexander

Recognized Expert
Posts: 198
Registered: ‎04-03-2015
0 Kudos

Re: HOW IS ASYMMETRIC ROUTING reflected in log session-end message

Hi,

 

There could be 2 scenarios in an asymmetric alow :-

Source A ------   SRX ------- Destination B

 

1) Traffic from A to B traverses through the SRX. Session would be created, no reply packets would be seen as the replies are taking a different path.

2) A to B does not traverse the SRX, however, the replies from B to A reach the SRX. For TCP  traffic, the packets would be dropped saying "First packet not sync".

 

I do not think that security logs would be helpful to identify this as this can be seen in security flow traceoptions.

 

Regards,

Sahil Sharma

Please mark my response as Solution if it Helps, Kudos are Appreciated as well.