<html><head></head><body bgcolor="#FFFFFF"><div>Since the session/ip/port information does not change, I very much doubt it had anything to do with the way source-nat replies are coming back.</div><div><br></div><div>I expect it had all to do with the much more logical impact of the various security features and packetprocessing/forwarding logic.</div><div><br></div><div>Are the replies coming back from at least the same MAC address?</div><div><br></div><div>Looking at your setup I'm quite sure they are not.</div><div>MAC info is also included in the sessioncache/state-tables.</div><div><br></div><div>For fast processing (as the ADX) in its core is a switch it would be most efficient to return packets belonging to a particular session to the MAC address the packets were received from...</div><div>Or for security reasons you normally would want packets from a particular session to keep coming in on the same interface from the same MAC address... as anti-spoofing solution.</div><div><br></div><div>There is a not-so well documented command to set this to IP based rather than MAC based if I remember correctly.</div><div><br></div><div>I can't find it for the moment, but will look into it tomorrow.</div><div><br></div><div><br></div><div>I have to add that asym-routing in general is bad and should be avoided.</div><div>Why is this happening in your network? And is there a way to avoid it?</div><div><br></div><div><br></div><div>Greetings,</div><div><br></div><div> Diederik</div><div><br>Sent from my iPhone</div><div><br>On 31 mei 2012, at 23:24, Drew Weaver <<a href="mailto:drew.weaver@thenap.com">drew.weaver@thenap.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">Hi,<div><br></div><div>I have recently experienced a problem where performance to a VIP is terrible when the ADX is uplinked to two separate routers running VRRP. TAC suggested that it is because source-nat replies were coming back on a different physical interface than the requests went out on.</div><div><br></div><div>In my config I have ports 1 and 3 assigned to the same VLAN with a virtual ethernet attached. If both of the physical ports are assigned to the same VLAN/VE then why would the ADX care which VLAN members the replies return on? That seems to defeat the purpose of having virtual ethernet or L3 VLAN style functionality.</div><div><br></div><div>There has to be a work around for this, does anyone know what it is?</div><div><br></div><div><br><br><br><br><br><span style="font-size:100%">Sent from my Samsung Galaxy Tab</span> </div></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>foundry-nsp mailing list</span><br><span><a href="mailto:foundry-nsp@puck.nether.net">foundry-nsp@puck.nether.net</a></span><br><span><a href="http://puck.nether.net/mailman/listinfo/foundry-nsp">http://puck.nether.net/mailman/listinfo/foundry-nsp</a></span></div></blockquote></body></html>