Description

This article describes the behavior of SRX to send ICMP redirect message when multiple IP addresses are configured under the same unit.

Symptoms

When multiple IP addresses are configured under the same unit, ICMP Redirect message can be sent out to the network configured with lower network address.

Topology

alt

Configuration

[SRX]

set interfaces reth0 redundant-ether-options redundancy-group 1
set interfaces reth0 unit 0 family inet address 192.168.2.254/24
set interfaces reth0 unit 0 family inet address 192.168.1.254/24

set security policies from-zone trust to-zone trust policy TRUST-TRAFFIC match source-address any
set security policies from-zone trust to-zone trust policy TRUST-TRAFFIC match destination-address any
set security policies from-zone trust to-zone trust policy TRUST-TRAFFIC match application any
set security policies from-zone trust to-zone trust policy TRUST-TRAFFIC then permit

set security zones security-zone trust interfaces reth0.0

[PC1]

IP Address: 192.168.1.1/24
Gateway: 192.168.1.254

[PC2]

IP Address: 192.168.2.1/24
Gateway: 192.168.2.254

When traffic from 192.168.1.0/24 network to 192.168.2.0/24 network is received, SRX sends out ICMP redirect packet back to the sender to redirect traffic to 192.168.2.0/24 network, but it will not happen direction in vice versa.

Result

[192.168.1.1 => 192.168.2.1]

ICMP redirect message is sent out to 192.168.1.1 with target host 192.168.2.1.

[192.168.2.1 => 192.168.1.1]

No ICMP redirect message is sent out to 192.168.2.1

What is the reason for this?

Solution

This is expected behavior of the current design of reth interface. The current design is that the local subnet table is checked from lower number of local subnet when SRX generates redirect message; it is not designed to check all the local subnets.

  1. When PFE prepares to send ICMP redirect packet, PFE will check the original address of packet is interface's LOCAL subnet.
    For this example case, 192.168.1.254 and 192.168.2.254 are the original addresses.
  2. PFE uses the primary address of interface to compare the original address and interface's LOCAL subnet, the smaller address is primary.
    The ICMP redirect can be sent out only when the source address of packet is in the primary address's subnet.
    For this example case, primary LOCAL address is 192.168.1.254.
  3. When PFE compares the original address and then it does not match, the primary address LOCAL subnet, SRX will not be able to
    send out ICMP redirect packet.
    For this example case, secondary address is 192.168.2.254.

In order to avoid sending out ICMP redirect messages to make consistent behavior among both networks, it is necessary  to add config set system no-redirects, commit and then reboot for the reconfiguration to take effect.

Modification History

2019-11-23: Removed note on Junos 11.4R11 from the solution.