Description

Application Policy-Based Routing is not working for reverse traffic

They have a tunnel set up on the SRX with servers hosted in the Azure cloud via Secure Edge. The traffic from internal (SRX LAN) clients reaches Azure servers. However, their Azure servers cannot reach directly down the tunnel to the internal (SRX LAN) network.

They can initiate a NEW connection to the servers hosted in Azure. This is traffic originating from 192.168.67.0/24 to Azure 10.7.0.0/16. When on an Azure server they try to initiate a NEW connection to a workstation stationed in the SRX LAN subnet They cannot access the workstation. This is traffic originating from Azure 10.7.0.0/16 to SRX LAN 192.168.67.0/24.

Solution

When traffic is initiated from LAN to Azure, communication works. However, when initiated from Azure to LAN, there is no connectivity. A new connection from Azure to LAN will be handled by the SRX same as from LAN to Azure, but since there is no APBR configuration for this context (direction), traffic is dropped.

 

Make sure there is an APBR profile and policy matching the traffic context.

Modification History

2023-10-10 : Article Created
12/7/2023: Formatting corrections made.