3

Okay guys I have a conundrum on my network, I do not know how it is working, I just know it does. I have a Juniper SSG firewall with 3 different ISPs. I have traffic coming in through the 3 interfaces, but somehow all outgoing traffic is sent through interface 1. How can this be possible?

Example: Client A sends a packet to Server B behind Juniper ethernet 0/1 ISP. Server B responds to Client A but the response is sent to Client A via ethernet 0/0. How does Client A know the response is valid if the response came from a different public IP? The same exact path is provided to the other ISP on ethernet 0/2, any signals that come in to the Juniper SSG on ethernet 0/2 are replied to through ethernet 0/0. These "servers" are alarm Receivers communicating to alarm panels on the field.

Further, if the ISP for ethernet 0/0 goes down (it is set as our primary for outbound), and Server B starts to reply to Client A on ethernet 0/1 or ethernet 0/2 they start screaming. (alarm signal receivers talking to panels on the field)

We have tested this and this is the way it appears to work. We do not understand why or how. Has anyone seen this before?

The reason we are asking is because we are looking to replace the Juniper SSG with a different product and we would like to replicate this same

  • Insufficient information. Perhaps your alarm panels don't care about the layer-3 information (IP), the firewall isn't changing any addresses, or traffic isn't flowing through the interfaces you think it is. – Ricky Beam Mar 19 '15 at 23:31
  • Ill run a whireshark and see what interface the receiver traffic is going out through. As far as i know its all IP based so i would assume that layer 3 is involved. Any other receiver functions over a POTS line. – veel84 Mar 20 '15 at 0:51
  • Do you do NAT? Perhaps the upstream ISP does not filter source IPs from other providers. It's all guesswork right now. Please give us a diagram of setup and the neccessary configurations bits (routing, interface config) so that we can better understand your setup. – Sebastian Wiesinger Mar 23 '15 at 10:31
  • @veel84 welcome! Feel free to edit your question to dial it in based on Ricky and Seb's comments... seems this could be a good Q. Probably "not clear" as it is now. – Craig Constantine Mar 24 '15 at 1:37
  • If possible show us your config get conf, just strip out any sensitive lines (eg the ones containing the words secret, password, preshare). – Gareth Hastings Apr 19 '15 at 10:53
1

This issue occurs with your Quad Zero route. You have routes bound to interfaces and if you are fulfilling requests from a priv or dmz interface and you have a 0.0.0.0 route offered on that interface that is the path the return traffic will take to get back to the requesting source. If you need the traffic to return from the interface it was received from your will need to redo your routing on the device.

Suggestion

If you have a service window you can schedule.

Research how you would like your 0.0.0.0 routing to work per interface. I would imagine you might have some end user requests for Internet passing through the device too and that would need to be taken into consideration.

Modify your txt config file to what you believe is functional and load it up during your service window.

Have your testing regiment planned out and try and hit every item. If you fall into an abyss, load your config that you know is functional and return to a steady state and revisit the issue during your next window. Plan it, test it, nail it. Good luck.

  • Great input , so these devices are constantly pinging our receivers on a static IP (let's say its an ATT IP). What I want to understand is why those devices are not freaking out when the reply comes back from a different IP (let's say the reply comes from a verizon IP). Is this possible? I'm wondering now if the client can be configured to ping one IP and expect the reply on a different IP. – veel84 Mar 20 '15 at 3:38
0

It turns out that all traffic is going back out the same interface it came in on. So, traffic that did not have a VIP or other policy took the default route out to the internet. So if traffic came in to looking for IP ABC.ABC.ABC.ADF went back out the same way ignoring the default gateway.

So the claims that when Client A contacted Client be out interface 0/1 and Client B responded through interface 0/0 were completely false.

Regardles, I had some great feedback from everyone, Thanks everyone!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.