SRX Services Gateway
SRX Services Gateway

HOW IS ASYMMETRIC ROUTING reflected in log session-end message

05.11.17   |  
‎05-11-2017 10:39 AM

we have from time to time communication problems via SRXdue to asymetric routing, the return traffic does use different way not touching the firewall at all.

I know how to handle that situation (interface nat or static route)


but due to specific cloud solutions we often do neither know sourceaddress, or destination adress or port, so detection is difficult


so my question: is there a specific searchable info in the security log written at session-end which helps us find such flows ? (where typically the return flow has 0 packets or any specific close-state)


thanks in advanc for help


SRX Services Gateway

Re: HOW IS ASYMMETRIC ROUTING reflected in log session-end message

05.12.17   |  
‎05-12-2017 11:45 AM



There could be 2 scenarios in an asymmetric alow :-

Source A ------   SRX ------- Destination B


1) Traffic from A to B traverses through the SRX. Session would be created, no reply packets would be seen as the replies are taking a different path.

2) A to B does not traverse the SRX, however, the replies from B to A reach the SRX. For TCP  traffic, the packets would be dropped saying "First packet not sync".


I do not think that security logs would be helpful to identify this as this can be seen in security flow traceoptions.



Sahil Sharma

Please mark my response as Solution if it Helps, Kudos are Appreciated as well.