HOW IS ASYMMETRIC ROUTING reflected in log session-end message
we have from time to time communication problems via SRXdue to asymetric routing, the return traffic does use different way not touching the firewall at all.
I know how to handle that situation (interface nat or static route)
but due to specific cloud solutions we often do neither know sourceaddress, or destination adress or port, so detection is difficult
so my question: is there a specific searchable info in the security log written at session-end which helps us find such flows ? (where typically the return flow has 0 packets or any specific close-state)
Re: HOW IS ASYMMETRIC ROUTING reflected in log session-end message
If in a-sync traffic the syn in seen but the syn-ack is not because of a direct path, two things will hapen:
A) The session is created with a intial time-out of 20 sec.
B) When the the syn-ack is not seen with this timeframe the session is closed with reason age-out.
So when you see sessions in your log with close reason age-out and a duration between 19 and 21 seconds (the 20 is not allways exact) you can savely assume you have async routing somewhere. Think second router on same subnet, think loadbalancer doing "half-nat".
Screenie. Juniper Ambassador, Instructor,JNCIP If this worked for you please flag my post as an "Accepted Solution" so others can benefit. A kudo would be cool if you think I earned it.