Re-creating a specific routing configuration.

[OMatlock]

Hello folks,

I am trying to reproduce a configuration from work where we use a Metro Line to connect our two sites.  It's working at my job, but not at home.  It seems like a simple setup and I think I am close, but having an issue.  Checking if anyone may have a comment?

My test is trying to connect to my esxi server from vsphere client, but unable to connect.  However, ping works everywhere.  Other traffic like web does not work either, just ping at the moment.

I've created static routes on the PA devices to handle traffic like it is at work.

PA 200 #1

PA 200 #2

Security Rule on PA 200 #2

[OMatlock]

Part of my troubleshooting.  The traffic log on PA 200 #2 does register traffic to the appropriate security rule, but says incomplete.  The pings are successful.  This example was me trying to access the esxi server IP via browser.

[bmorris1]

Hi @OMatlock,

I wonder if you have asynchronus routing caused by the switch 1. Can you try running a packet capture on the interface circled to see if the return traffic is coming back to the wrong interface?  As I understand it you want the traffic to be coming back to ethernet1/3 on the PA-200 #2.

If this is the issue then I would think you can resolve it with a NAT rule.

hope this helps,

Ben

[OMatlock]

Thank for responding bmorris1.

I did have ip routing enabled on switch 1, but have now disabled it.  Still same issue.

I ran a capture on PA 200 #2 using filters for these two specific ips and ingress interface 1/2.  You can see the pings are successful, but attempting to browse the web page of this server does not work.  Works fine when client is on the same subnet.

If you have any other comments, let me know!  🙂  I will be focusing on it during my t-giving break.

I was thinking that the ingress and egress indications from the traffic log are correct.  When pinging (or attempting to access) from 192.168.32.25 to 192.168.33.143, it seems correct for egress to be 1/3 and ingress to be 1/2.  Sound/look right?

[rmfalconer · Accepted solution]

Your traffic is asymmetric.

TCP SYN traffic arrives on PA2 with a destination of the ESX server. ESX server responds with SYN ACK which goes to PA1 since that's the gateway. PA1 didn't see the initial SYN so it won't work. Ping doesn't have this problem since it doesn't need the handshake. Generally, if you see ping working but nothing else, it's asymmetry of some kind.

Any firewalls that the traffic traverses need to see the three-way handshake.

[OMatlock]

Thank you for responding rmfalconer.

I am now reading more about asymmetric networking and will try to figure this out by comparing with our network at my job.  Folks that configured it originally are gone and I am trying to catch up...

I will do some more research and respond to this thread this week.  I will close if can't resolve and keep updating as I make progress.