topic Re: Asymmetric traffic using ECMP with static routes in Firewall and Security Management

Asymmetric traffic using ECMP with static routes

Kebin23 — Sun, 01 Oct 2023 06:46:51 GMT

Hello checkpoint community.

I am experiencing an asymmetric traffic problem in my lab when I try to use ECMP to advertise a server to 2 IPs from different ISPs at the same time.

I have configured the following default route for my two gateways from each ISP.

Leave the ECMP configuration by default at GAIA.

When both ISP links are UP, I reach the IP with which the server is published on ISP2 through port eth03 but the response returns through eth0, as shown in the following image.

When I run the fw monitor, I see that it sends it through eth0, because that is the default route and that route also uses the public segment of my site 1 from where I am doing the test, I show the image of the fw monitor.

When I download eth0, the default route that the firewall is considering for all traffic, the traffic is no longer asymmetric since my new default route goes through ISP2 where my server is published. I attach the image of the fw monitor.

What remaining configuration in the firewall or ECMP am I missing so that the queries to the published server with an IP from ISP2 are symmetrical?

Laboratory topology

Re: Asymmetric traffic using ECMP with static routes

G_W_Albrecht — Mon, 02 Oct 2023 07:18:09 GMT

Why not consult TAC for this isssue ?

Re: Asymmetric traffic using ECMP with static routes

PhoneBoy — Mon, 02 Oct 2023 13:17:42 GMT

This "feels" like a SecureXL issue.
You can somewhat test this theory by temporarily disabling templating with fwaccel off.
Note this may not stop accelerating the traffic: https://support.checkpoint.com/results/sk/sk162492
Either way, I strongly suggest consulting with the TAC: https://help.checkpoint.com

Re: Asymmetric traffic using ECMP with static routes

Kebin23 — Tue, 03 Oct 2023 18:13:21 GMT

Hi @PhoneBoy .

Thanks for the information, I will try disabling acceleration if that solves it.

Re: Asymmetric traffic using ECMP with static routes

Kebin23 — Tue, 03 Oct 2023 21:03:58 GMT

Hi @PhoneBoy .

Disable the acceleration and the problem with that link is solved, but the asymmetry now occurs in eth0, which previously worked correctly. In short, the problem continues, only now on the side of ISP1.

Re: Asymmetric traffic using ECMP with static routes

PhoneBoy — Tue, 03 Oct 2023 22:23:56 GMT

As suggested previously, a TAC case will likely be necessary to resolve the issue.