Fault resolution: Implementing ECMP functions on the firewall

Fault resolution: Implementing ECMP functions on the firewall

I. Network Topology

Ii. basic configuration

1. The Gateway in the workplace is the EX4200 of Juniper, Which is configured with vlan524: 10.63.224.0/24 and vlan525: 10.63.225.0/24. Configure the next hop of the default route to point to the firewall.

2. Two Internet leased lines (China Telecom and China Mobile) are connected on the firewall SSG550-1, and two default routes are configured with the next hop pointing to the carrier respectively. For example:

 

 

 

 

3. FirewallConfigure a vro.

 

4. FirewallSet the 224 CIDR block to access the Internet through the telecom leased line, and the 225 CIDR block to access the Internet through the mobile leased line.

 

 

 

 

5. add firewall policies

 

Ii. Fault

 

1. Sometimes 225 CIDR blocks can access the Internet through a mobile leased line, and sometimes cannot access the Internet through a mobile leased line.

2. trace the Internet address 219.142.1.170 on the firewall, and the result is to go out through the telecom leased line.

 

For example:

 

Iii. Solution

1. The analysis shows that the ECMP function is not enabled on the firewall, and the traffic cannot be transmitted simultaneously on both lines.

 

 

 

Iv. Conclusion

1. The problem has been resolved after verification.