Customer has a standalone SRX with 2 Active WAN links.

MIST auto creates 2 separate Security Zones and places both the WAN links in their respective Zone as expected.

In this scenario, if ECMP is enabled and packets start to get load balanced between the 2 WAN Links, it was noticed that the Return packets are getting dropped (Default Policy/no policy match)

If only one ISP/WAN Link is active, everything works fine.

ECMP with Dual WAN Links in Active/Active setup causing return packet drop due to no policy match/default Deny.

Sep 28 17:35:04 17:35:04.406297:CID-0:RT:  app 0, timeout 60s, curr ageout 60s
Sep 28 17:35:04 17:35:04.406297:CID-0:RT:  packet dropped, denied by policy
Sep 28 17:35:04 17:35:04.406297:CID-0:RT:  denied by policy default-policy-logical-system-00(2), dropping pkt
Sep 28 17:35:04 17:35:04.406297:CID-0:RT:  packet dropped,  policy deny.

This is an Expected Behavior as the return traffic is not guarantied to arrive on the same SRX Outgoing Interface.

Packets leaving from WAN1 and the return packet arriving on WAN2 will be dropped due to Different Zone.

To address this issue, use the additional CLI option on MIST GUI to place both the WAN Links in the same Security Zone.

Post making the change, run the packet-drop command to confirm that no packets are dropped.

monitor security packet-drop

For ECMP with Active/Active Cluster, please refer : ECMP A/A Cluster

N/A