topic ISP redundancy and Security Zones in Firewall and Security Management

ISP redundancy and Security Zones

yura_k — Mon, 11 Mar 2024 15:54:17 GMT

Hi team!

Two 6400 appliances in the A/S cluster, Gaia R81.20 JHF41. Two ISPs (/29 subnets), Primary/Backup mode. NAT policy is made using Security Zones. Recently we faced the following situation.

When fail-over occurs, ISP from Primary ISP to Backup ISP, all outgoing ICMP requests and TCP sessions are re-established correctly. But some UDP sessions "hang" and are sourced with the address of the Primary ISP.

TAC in my case wrote that "Old connections will not change NAT by design. This as confirmed by the developer is by design this is because the connection is recorded in the connection table."

How do I get to automatically perform UDP sessions cleanup from connections table?

Re: ISP redundancy and Security Zones

PhoneBoy — Wed, 13 Mar 2024 22:13:18 GMT

The way I understand what TAC said, it sounds like this would require an RFE.
It is possible to remove connections from the connections table (fw tab -x, I believe), but it would require some scripting to parse the connections table and figure out which ones to remove.

Re: ISP redundancy and Security Zones

the_rock — Wed, 13 Mar 2024 22:41:00 GMT

If TAC confirmed it and developer said the same, then what @PhoneBoy advised makes total sense. Sounds like RFE to me.

Best,

Andy

Re: ISP redundancy and Security Zones

yura_k — Fri, 15 Mar 2024 08:46:53 GMT

Hi! If I understand correctly, when client A sends UDP data to server B via CP, a virtual UDP session is created, which has a timeout (40 seconds by default).

If a UDP reply from server B to client A arrives, is it a second virtual session, which is in no way linked to the first virtual session?

Re: ISP redundancy and Security Zones

PhoneBoy — Fri, 15 Mar 2024 22:49:01 GMT

If that reply comes within 40 seconds, it's considered part of the same session.