Routing - Extra Hop Issue

[GRANT3779]

Hi All,

I recently came across an issue and still unsure as to why this caused the problem that it did..

I'll explain..

All our services are hosted offsite (Exchange etc.). We will call this "HostedSite"

Site A had IP connectivity to the "HostedSite" (ping server addresses etc..). However Outlook would not connect.

Tracerts from Site A to HostedSite showed the expected path.

Tracerts from HostedSite back to Site A showed 1 extra hop at our HUB site (interim point between the 2), but apart from this, no issues.

After amending the routing and removing this extra 1 hop the return traffic took, Outlook connected and all was good.

Any idea why this 1 extra hop on the return traffic caused the problems, as both sites could ping each other but Outlook wouldn't connect until the return traffic took the exact same route back. I wouldn't have thought the route back mattered, as long as traffic could flow between the 2 sites?

[Bilal Nawaz]

Hello, if the traffic was flowing through firewalls the asymmetric routing would have broken any TCP connections that outlook tries to make to the CAS arrays/your exchange.

Even with a load-balancer you may have the same effect.

Hope this helps.

Sent from Cisco Technical Support iPhone App

[GRANT3779]

Thanks a lot for that. After doing some reading, that makes sense.

Would a Riverbed at each end of the traffic flow cause this at all?

[Bilal Nawaz]

Is this a loadbalancer or the firewall appliances? This below, applies to both FW's and LB's in a standard configuration, so it is very possible that this was the cause. As soon as you fixed the asymmetric routing/paths, it makes sense that it started working again.

I'll try to explain a bit about what I think might be happening.

You have the TCP 3 way handshake right?

1) When a PC sends out an initial connection it sends out a SYN.

2) Exchange is meant to reply back with a SYN-ACK

3) And the client then responds with a ACK

So if we have asymmetric routing,

1) The client sends a SYN - this routes direct to the exchange (without the hop)

2) Exchange responds back with a SYN-ACK but sends that back to the hop - (This hop didnt see the first SYN, so it doesnt know why its getting a SYN-ACK, so its dropped)

And I think this is where the connection might have been broken.

Hope this helps.

Please rate useful posts and remember to mark any solved questions as answered. Thank you.