3

Okay guys I have a conundrum on my network, I do not know how it is working, I just know it does. I have a Juniper SSG firewall with 3 different ISPs. I have traffic coming in through the 3 interfaces, but somehow all outgoing traffic is sent through interface 1. How can this be possible?

Example: Client A sends a packet to Server B behind Juniper ethernet 0/1 ISP. Server B responds to Client A but the response is sent to Client A via ethernet 0/0. How does Client A know the response is valid if the response came from a different public IP? The same exact path is provided to the other ISP on ethernet 0/2, any signals that come in to the Juniper SSG on ethernet 0/2 are replied to through ethernet 0/0. These "servers" are alarm Receivers communicating to alarm panels on the field.

Further, if the ISP for ethernet 0/0 goes down (it is set as our primary for outbound), and Server B starts to reply to Client A on ethernet 0/1 or ethernet 0/2 they start screaming. (alarm signal receivers talking to panels on the field)

We have tested this and this is the way it appears to work. We do not understand why or how. Has anyone seen this before?

The reason we are asking is because we are looking to replace the Juniper SSG with a different product and we would like to replicate this same

Improve this question
5
  • Insufficient information. Perhaps your alarm panels don't care about the layer-3 information (IP), the firewall isn't changing any addresses, or traffic isn't flowing through the interfaces you think it is.
    – Ricky
    Mar 19, 2015 at 23:31
  • Ill run a whireshark and see what interface the receiver traffic is going out through. As far as i know its all IP based so i would assume that layer 3 is involved. Any other receiver functions over a POTS line.
    – veel84
    Mar 20, 2015 at 0:51
  • Do you do NAT? Perhaps the upstream ISP does not filter source IPs from other providers. It's all guesswork right now. Please give us a diagram of setup and the neccessary configurations bits (routing, interface config) so that we can better understand your setup.
    – Sebastian Wiesinger
    Mar 23, 2015 at 10:31
  • @veel84 welcome! Feel free to edit your question to dial it in based on Ricky and Seb's comments... seems this could be a good Q. Probably "not clear" as it is now.
    – Craig Constantine
    Mar 24, 2015 at 1:37
  • If possible show us your config get conf, just strip out any sensitive lines (eg the ones containing the words secret, password, preshare).
    – Gareth Hastings
    Apr 19, 2015 at 10:53

2 Answers 2

Reset to default
1

This issue occurs with your Quad Zero route. You have routes bound to interfaces and if you are fulfilling requests from a priv or dmz interface and you have a 0.0.0.0 route offered on that interface that is the path the return traffic will take to get back to the requesting source. If you need the traffic to return from the interface it was received from your will need to redo your routing on the device.

Suggestion

If you have a service window you can schedule.

Research how you would like your 0.0.0.0 routing to work per interface. I would imagine you might have some end user requests for Internet passing through the device too and that would need to be taken into consideration.

Modify your txt config file to what you believe is functional and load it up during your service window.

Have your testing regiment planned out and try and hit every item. If you fall into an abyss, load your config that you know is functional and return to a steady state and revisit the issue during your next window. Plan it, test it, nail it. Good luck.

Improve this answer
1
  • Great input , so these devices are constantly pinging our receivers on a static IP (let's say its an ATT IP). What I want to understand is why those devices are not freaking out when the reply comes back from a different IP (let's say the reply comes from a verizon IP). Is this possible? I'm wondering now if the client can be configured to ping one IP and expect the reply on a different IP.
    – veel84
    Mar 20, 2015 at 3:38
0

It turns out that all traffic is going back out the same interface it came in on. So, traffic that did not have a VIP or other policy took the default route out to the internet. So if traffic came in to looking for IP ABC.ABC.ABC.ADF went back out the same way ignoring the default gateway.

So the claims that when Client A contacted Client be out interface 0/1 and Client B responded through interface 0/0 were completely false.

Regardles, I had some great feedback from everyone, Thanks everyone!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.