Allow active connections in firewall on multiple BGP connected routers

Question

We have a network on its own AS with 2 routers connected to 2 AS via BGP (full routes).

The routers also both have a firewall on board that by default drops all traffic, except the one allowed. We allow traffic to specific ports on specific IP addresses to be forwarded, but nothing else.

There's also a rule that defines any connections opened by our servers should be tracked and return packets are allowed for those connections.

This all works fine as long as the outgoing and incoming traffic for a single connection is going through the same uplink, but when a connection attempt from a server to a remote host is sent outgoing on 1 link, but the return packet comes from the other link, the router logically won't forward it.

Does anyone have any suggestions on how we can resolve this ?

Answer 1

As you figured out, doing stateful firewalling on external links doesn't work well if you're multihomed. Typically, you either do stateless firewalling on external links, or place the firewall behind the routers so you don't have to deal with asymmetric routing.