Steven, this should help: } forwarding-options { hash-key { family inet { layer-3; layer-4; } } } Without the hash defined, even with a policy present, load balancing doesn't seem to work.