Tunnel Traffic from ISP2 IP Working Despite Default Route on ISP1 – Need Insights?

[AkashThangavel]

Hi Team,

🔁 Scenario Summary for Asymmetric routing

Primary ISP (ISP1): Default route with lower metric (10), so all traffic prefers this path.
Secondary ISP (ISP2): In Firewall, I manually initiate traffic using ping source <ISP2 IP> host 8.8.8.8.
Routing Table: Since 8.8.8.8 is unknown, the firewall uses the default route — which points to ISP1.
Result: Traffic goes out via ISP1, but the source IP is from ISP2. Return traffic will go to ISP2.
⚠️ Why This Might Not Work
This setup can cause asymmetric routing, where:

Outbound traffic goes via ISP1.
Inbound traffic returns via ISP2.
This can lead to:

Dropped packets due to stateful inspection (firewall sees return traffic on a different interface).
Routing inconsistencies unless properly handled.

---

🛠️ What Happens for the tunnel traffic in ISP-2

If we don’t add a static route for the remote peer public IP:

• The firewall uses the default route (ISP1).
• IKE traffic goes out via ISP1 with ISP2’s source IP.
• The return traffic comes to ISP2.
• The firewall drops the return traffic due to asymmetric routing.

🔧But tunnel traffic is still working, even though there is no static route configured for the peer's public IP.

Can someone break down the reason behind this?

Regards,

Akash Thangavel