Symmetric return on L2 subinterface fails after some time

Reply
Highlighted
L0 Member

Symmetric return on L2 subinterface fails after some time

We are running the latest PanOS 8.1 version on a PA3050 and we want to make use of symmetric return. In general this is working just fine, but it seems we are triggering a corner case. We can successfully initiate an SSH session (i.e. key exchange, authentication etc. work like a charm), but after 4-5 characters on the prompt, the session freezes. So far we have found that the freeze is caused by VLAN tags not being present in the outgoing return packets.

 

Example:

Client 192.168.1.13 behind Router 10.100.1.244 connected to PA on ethernet1/2.410 wants to connect to server 192.168.2.21:22 connected to PA on ethernet1/2.835.

Without PBF the client 192.168.1.13 is in another VLAN directly connected to the same PA, but we have found that this doesn't matter. It does matter that the client is not directly connected to the same VLAN -- i.e. traffic originated by 10.100.1.244 (also matching the PBF rule) works flawlessly.

 

We have a PBF like that:

<entry name="return">
  <action>
    <no-pbf/>
  </action>
  <from>
    <interface>
      <member>vlan.410</member>
    </interface>
  </from>
  <enforce-symmetric-return>
    <enabled>yes</enabled>
    <nexthop-address-list>
      <entry name="10.100.1.244"/>
    </nexthop-address-list>
  </enforce-symmetric-return>
  <source>
    <member>any</member>
  </source>
  <destination>
    <member>n_192.168.2.0-24</member>
  </destination>
  <source-user>
    <member>any</member>
  </source-user>
  <application>
    <member>any</member>
  </application>
  <service>
    <member>s_ssh</member>
  </service>
</entry>

I.e. no-pbf for the forward section and symmetric return via the router.

 

Has anyone ever come accross this issue? Any idea why after some time the VLAN tag 410 is just dropped from return packets?

 

What bugs me the most: The session is running like a charm ... until after the handshake (application detection?) and only then the VLAN tags goes missing.

 

Thanks for ideas,

André

 

PS: So far the first level support was not very helpful with this issue.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!