I currently have a total of 4 locations with clustered SRX650's. Each location also has redundant internet connections. We'll call the locations Office1, Office2, DC1, DC2. Currently the offices are not directly connected and connect to both DC over every possible combination of providers. I'll use "O#", "D#" and "P#" as shorthand for the locations and providers. For example:

O1-P1 -> D1-P1

O1-P2 -> D1-P1

O1-P1 -> D1-P2

O1-P2 -> D1-P2


Each provider-pair connection is a distinct IPSec VPN and OSPF is used for route propagation. Using this topology any one internet connection at each location can fail, simultaneously, and traffic will still flow. The problem I'm having now is that traffic between Office1 and Office2 can take an asymmetric route and the SRX at each office don't seem to allow that traffic to pass.

Having tried the no-syn-check and no-sequence-check flow options, how do I let the asymmetric traffic pass or if there's no good way to do that, what network design would best suit? I'm not a network engineer by anything other than on-the-job work by myself so I'm very open to better ideas than my implementation!

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14, 2017 at 1:47

1 Answer 1


With stateful firewalls, you will always have this issue with asymmetric routing. It's unavoidable.

One idea is to put the firewall behind the border routers, so that all traffic always flows through the same firewall no matter which path is used.

  • Currently my firewalls are also my routers. I guess I've been lucky to be able to squeak by with routing and firewall services on the same device until this point. Apr 20, 2016 at 20:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.