Can Messaging Gateway do asymmetric routing of TCP/IP

Products

• Messaging Gateway

Issue/Introduction

Messaging Gateway (SMG) does not do asymmetric routing of IP packets but, in some configurations may respond to connections to Ethernet Interface 2 (eth1) from Ethernet Interface 1 (eth0) which may be mistaken by some firewalls as asymetric routing.

Cause

Messaging Gateway uses a simple static routing table with the default route bound to eth0 (Internet Interface 1).

If both network interfaces are configured and a connection to eth1 (Internet Interface 2) is made from an IP that is not on the local network / subnet of the IP bound to eth1, SMG will use the default route for responses to that connection and so responses will be sent from eth0 rather than from eth1.

Connections to the IP bound to eth1 from the local network configured for eth1 will be responded to from eth1 since those IPs would be on the local subnet that eth1 is attached to.

Example

In the network configuration below, SMG is configured with two IPs and both IPs are on the same IP subnet. Connections to the 10.0.1.26 IP from any IP that is not on the 10.0.1.0/24 network would be responded to from the eth0 interface (Ethernet Interface 1) since that is the interface that the default route (0.0.0.0) is bound to.

Kernel IP routing table
Destination   Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0       10.0.1.1        0.0.0.0         UG    0      0      0   eth0
10.0.1.0      0.0.0.0         255.255.255.0   U     0      0      0   eth0
10.0.1.0      0.0.0.0         255.255.255.0   U     0      0      0   eth1

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.1.25  netmask 255.255.255.0  broadcast 10.0.1.255

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.1.26  netmask 255.255.255.0  broadcast 10.0.1.255

Resolution

This is expected behavior when SMG is configured with multiple IPs on the same subnet or connections to eth1 (Ethernet Interface 2) are made from IPs not on the eth1 local subnet.

Messaging Gateway can have additional static routes added to the routing table via the Administration > Configuration > host > Ethernet > Routing configuration if the default routing needs to be overidden for some internal networks. By default, SMG will use eth0 (Ethernet 1)  when configuring static routes but the interface to use for static routes can be set in the route configuration.