Asymmetric Routing

[guesstimation]

Hi,

We have this route-based VPN with partner. It is static routing with VPN site A as preferred.

Problem that sometimes partner, which is normally on-site A, becomes Active on B site, while our route is still points to A. We see traffic all looks good, just the thing that we send traffic to site A and get it back through site B. Looking at the logs i don't see drops, but users say they have no connection.  Spoofing is not an issue, so not sure what exactly kills the connection.  I assume Asymmetric routing is to blame one way or another.

>Is there any way to live with Asymmetric routing situation in Route Based VPN? 

(At the moment i have only static routing at my disposal, as have some corporate limitations on running dynamic routing on the firewalls.)

Thank you.

[Vladimir]

Not sure if this would work, but in static routes, there is a way to configure IP Monitoring with "Force Interface Symmetry". You can play with that option.

[guesstimation]

Thanks, this does look like a potential way to resolve this.

[the_rock]

Learned something new. Never seen that option before @Vladimir . Thanks for pointing that out 🙌

[Timothy_Hall]

What strange sorcery is this Vladimir? 😀  Never heard of "Force Interface Symmetry" for route IP Monitoring either.  Guess these are things you find out when you write a book or something.

[the_rock]

@Timothy_Hall haha, yea, things you find out when you write a book, not that I would know 😂😂. By the way, both your and @Vladimir 's book...FANTASTIC 👌👍

[Vladimir]

To paraphrase Forrest Gump: Check Point is like a box of chocolates...

[the_rock]

There is an idea for CPX slogan ; - )

[Vladimir]

Yeah, I can see it going well with CP marketing:)

[the_rock]

I know lol. But, in all honesty, me personally, I could care less what company motto/slogan is, as long as the product works and support is good.