Description

This article explains why SRX may fail to reach to the target (have multiple equal cost paths) when Equal-cost multipath (ECMP) is use.

Symptoms

alt

When ECMP is in use, SRX itself may fail to reach the target. 

root@srx# run show route forwarding-table destination 70.1.1.0
Routing table: default.inet
Internet:
Destination        Type RtRef Next hop           Type Index    NhRef Netif
70.1.1.0/24        user     0                    ulst   262142     2
                              10.1.1.2           ucst      533     2 ge-0/0/0.0
                              20.1.1.2           ucst      534     2 ge-0/0/1.0
                              30.1.1.2           ucst      535     2 ge-0/0/2.0

root@srx> show security flow session destination-prefix 70.1.1.2    
Session ID: 35547, Policy name: self-traffic-policy/1, Timeout: 2, Valid
  In: 10.1.1.1/0 --> 70.1.1.2/29038;icmp, Conn Tag: 0x0, If: .local..0, Pkts: 1, Bytes: 84,
  Out: 70.1.1.2/29038 --> 30.1.1.1/3530;icmp, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 1, Bytes: 0, <-- ping failed


This is because if there is an ECMP set for the active route, Junos uses a hash algorithm to select one of the next-hop addresses in the ECMP set to install in the forwarding table. However, SRX might select the Source IP address which is different from the one that belongs to the real output interface. At the same time, the peer device does not have the related route information, so traffic may fail.

Solution

There are two ways to resolve this issue.

  1. Set interface lo0 and add Source NAT as shown below: 

    set interfaces lo0 unit 0 family inet address 1.1.1.1/32
set security nat source rule-set 1 from zone junos-host
set security nat source rule-set 1 to zone untrust  <<<ge-0/0/0, ge-0/0/1, ge-0/0/2 are under zone untrust
set security nat source rule-set 1 rule 1 match source-address 0.0.0.0/0
set security nat source rule-set 1 rule 1 match destination-address 0.0.0.0/0
set security nat source rule-set 1 rule 1 then source-nat interface

root@srx> show security flow session destination-prefix 70.1.1.2    
Session ID: 35565, Policy name: self-traffic-policy/1, Timeout: 2, Valid
  In: 1.1.1.1/2 --> 70.1.1.2/40814;icmp, Conn Tag: 0x0, If: .local..0, Pkts: 1, Bytes: 84,
  Out: 70.1.1.2/40814 --> 20.1.1.1/7503;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 1, Bytes: 84,  <--- Source NAT will work

  2. You can also set specific routes for the specific target as shown below: 

    set routing-options static route 70.1.1.2/32 next-hop 10.1.1.2

root@srx> show security flow session destination-prefix 70.1.1.2    
Session ID: 35573, Policy name: self-traffic-policy/1, Timeout: 2, Valid
  In: 10.1.1.1/0 --> 70.1.1.2/64111;icmp, Conn Tag: 0x0, If: .local..0, Pkts: 1, Bytes: 84,
  Out: 70.1.1.2/64111 --> 10.1.1.1/30221;icmp, Conn Tag: 0x0, 
If: ge-0/0/0.0, Pkts: 1, Bytes: 84, <<<<The traffic to 70.1.1.2 will always choose ge-0/0/0 with Source IP 10.1.1.1</pre>

Related Information