topic Re: Tunnel Traffic from ISP2 IP Working Despite Default Route on ISP1 – Need Insights? in Next-Generation Firewall Discussions

Tunnel Traffic from ISP2 IP Working Despite Default Route on ISP1 – Need Insights?

AkashThangavel — Wed, 03 Sep 2025 06:08:58 GMT

Hi Team,

🔁 Scenario Summary for Asymmetric routing

Primary ISP (ISP1): Default route with lower metric (10), so all traffic prefers this path.
Secondary ISP (ISP2): In Firewall, I manually initiate traffic using ping source <ISP2 IP> host 8.8.8.8.
Routing Table: Since 8.8.8.8 is unknown, the firewall uses the default route — which points to ISP1.
Result: Traffic goes out via ISP1, but the source IP is from ISP2. Return traffic will go to ISP2.
⚠️ Why This Might Not Work
This setup can cause asymmetric routing, where:

Outbound traffic goes via ISP1.
Inbound traffic returns via ISP2.
This can lead to:

Dropped packets due to stateful inspection (firewall sees return traffic on a different interface).
Routing inconsistencies unless properly handled.

🛠️ What Happens for the tunnel traffic in ISP-2

If we don’t add a static route for the remote peer public IP:

The firewall uses the default route (ISP1).
IKE traffic goes out via ISP1 with ISP2’s source IP.
The return traffic comes to ISP2.
The firewall drops the return traffic due to asymmetric routing.

🔧But tunnel traffic is still working, even though there is no static route configured for the peer's public IP.

Can someone break down the reason behind this?

Regards,

Akash Thangavel

Re: Tunnel Traffic from ISP2 IP Working Despite Default Route on ISP1 – Need Insights?

reaper — Fri, 05 Sep 2025 09:24:08 GMT

if both your ISP1 and ISP2 interfaces use the same zone, asymmetric routing is ignored

Re: Tunnel Traffic from ISP2 IP Working Despite Default Route on ISP1 – Need Insights?

AkashThangavel — Fri, 05 Sep 2025 10:01:58 GMT

Hi Tom Piens,

Are there any documents, and how is the tunnel still working even though it's in a different zone?

Re: Tunnel Traffic from ISP2 IP Working Despite Default Route on ISP1 – Need Insights?

reaper — Tue, 09 Sep 2025 09:19:49 GMT

are you saying both ISP1 & ISP2 interfaces have a different zone?

then you should review your security policy

is the tunnel responder or initiator?

if you look at your session table, can you find the tunnel session and identify the interfaces (maybe also set up a flow basic capture to see which interfaces are really used)