topic Re: Asymmetric Routing in Firewall and Security Management

Asymmetric Routing

guesstimation — Sun, 05 Mar 2023 17:05:35 GMT

Hi,

We have this route-based VPN with partner. It is static routing with VPN site A as preferred.

Problem that sometimes partner, which is normally on-site A, becomes Active on B site, while our route is still points to A. We see traffic all looks good, just the thing that we send traffic to site A and get it back through site B. Looking at the logs i don't see drops, but users say they have no connection. Spoofing is not an issue, so not sure what exactly kills the connection. I assume Asymmetric routing is to blame one way or another.

>Is there any way to live with Asymmetric routing situation in Route Based VPN?

(At the moment i have only static routing at my disposal, as have some corporate limitations on running dynamic routing on the firewalls.)

Thank you.

Re: Asymmetric Routing

Vladimir — Sun, 05 Mar 2023 18:05:21 GMT

Not sure if this would work, but in static routes, there is a way to configure IP Monitoring with "Force Interface Symmetry". You can play with that option.

Re: Asymmetric Routing

guesstimation — Mon, 06 Mar 2023 16:14:01 GMT

Thanks, this does look like a potential way to resolve this.

Re: Asymmetric Routing

the_rock — Mon, 06 Mar 2023 16:30:28 GMT

Learned something new. Never seen that option before @Vladimir . Thanks for pointing that out 🙌

Re: Asymmetric Routing

Timothy_Hall — Mon, 06 Mar 2023 17:57:06 GMT

What strange sorcery is this Vladimir? 😀 Never heard of "Force Interface Symmetry" for route IP Monitoring either. Guess these are things you find out when you write a book or something.

Re: Asymmetric Routing

the_rock — Mon, 06 Mar 2023 18:17:24 GMT

@Timothy_Hall haha, yea, things you find out when you write a book, not that I would know 😂😂. By the way, both your and @Vladimir 's book...FANTASTIC 👌👍

Re: Asymmetric Routing

Vladimir — Mon, 06 Mar 2023 19:56:15 GMT

To paraphrase Forrest Gump: Check Point is like a box of chocolates...

Re: Asymmetric Routing

the_rock — Mon, 06 Mar 2023 20:52:33 GMT

There is an idea for CPX slogan ; - )

Re: Asymmetric Routing

Vladimir — Mon, 06 Mar 2023 23:14:05 GMT

Yeah, I can see it going well with CP marketing:)

Re: Asymmetric Routing

the_rock — Mon, 06 Mar 2023 23:17:17 GMT

I know lol. But, in all honesty, me personally, I could care less what company motto/slogan is, as long as the product works and support is good.