SD-WAN and symmetric return of packets from inbound connections

[Pedro_Espindola]

In the list of limitations of SD-WAN, we see this:

"PMTR-104986: For inbound connections from the internet, SD-WAN does not support the symmetric return of packets through the same interface on which the connection was originally received, in case of multiple ISPs.

The return will be determined based on the OS routes."

That seems like a very basic limitation. and a step back since it is even supported in ISP redundancy, which was already a very archaic feature.

This means that differently from IPS redundancy, which returns packets through the same interface the connection was received, SD-WAN will route traffic through the prefered OS route. Thus, you cannot have a server published through more than one isp link and one inbound NAT rule for each isp link, it will only work through one link.

The methods I found to deal with this are:

1. Lock the server through an ISP. No redundancy.
2. Having 2 IP addresses configured in the server and NAT rules and PBR configured for each address. (A lot of extra work)
3. Having 2 servers running this service.  (Even more extra work!)

I'm interested to know how other people in this forum are dealing with this. Does everyone have load balancers for inbound connections? Am I missing something?

[AmirArama]

Hi,

Indeed, this is basic limitation.

We already have the fix for it. So the return (s2c) packets will be routed back from the same ISP the connection (c2s) originally came through.

it should be merged into JHF that will be released in the next month or so for GAIA. 

As a temp workaround:

If you need the redundancy to the server works as active/backup, you can just set two default routes on your GAIA with different priorities, with "IP Reachability Detection" configured (if you want to probe the line. Otherwise just with "ping on"). So once main line is dead, the active route would be the second ISP, and then the server would be accesible through it. 

In case you need it to be accesible in parallel via multiple ISPs, i afraid only your PBR idea can work.

Let me know if you need further assistance,