I currently have a total of 4 locations with clustered SRX650's. Each location also has redundant internet connections. We'll call the locations Office1, Office2, DC1, DC2. Currently the offices are not directly connected and connect to both DC over every possible combination of providers. I'll use "O#", "D#" and "P#" as shorthand for the locations and providers. For example:
O1-P1 -> D1-P1
O1-P2 -> D1-P1
O1-P1 -> D1-P2
O1-P2 -> D1-P2
Each provider-pair connection is a distinct IPSec VPN and OSPF is used for route propagation. Using this topology any one internet connection at each location can fail, simultaneously, and traffic will still flow. The problem I'm having now is that traffic between Office1 and Office2 can take an asymmetric route and the SRX at each office don't seem to allow that traffic to pass.
Having tried the no-syn-check and no-sequence-check flow options, how do I let the asymmetric traffic pass or if there's no good way to do that, what network design would best suit? I'm not a network engineer by anything other than on-the-job work by myself so I'm very open to better ideas than my implementation!