Internal Load Balancer is doing asymmetric routing.

Hello @Prashant Gaur ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you have a hub and spoke topology with 2 load balancers (one public and one internal) which is integrated with Azure Firewall for inbound & outbound traffic, but you are facing asymmetric routing issue with the Azure Private (Internal) load balancer.

Integration of an Azure Standard Load Balancer (either public or internal) with your Azure firewall scenarios are explained in the below doc:

https://video2.skills-academy.com/en-us/azure/firewall/integrate-lb

Asymmetric routing issue only happens with the public load balancer scenario.

Refer: https://video2.skills-academy.com/en-us/azure/firewall/integrate-lb#asymmetric-routing

There's no asymmetric routing issue with an internal load balancer scenario.

Refer: https://video2.skills-academy.com/en-us/azure/firewall/integrate-lb#internal-load-balancer

However, the above scenarios assumes that you are using either a public load balancer or an internal load balancer and routing all traffic to Azure Firewall via UDR.

Your setup is explained in the below doc:

https://video2.skills-academy.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha#load-balancer-design

Here, you can see the cause of asymmetric routing:

For traffic between Azure and the public Internet, each direction of the traffic flow will cross a different Azure Load Balancer (the ingress packet through the public ALB, and the egress packet through the internal ALB). As a consequence, if traffic symmetry is required, Source Network Address Translation (SNAT) needs to be performed by the NVA instances (Azure Firewall instances in your case) to attract the return traffic and avoid traffic asymmetry.

I'm not sure how your Azure Firewall has been configured but coming back to your question, I see you've mentioned that your setup works fine when you enable the option: "Client IP + Protocol" for session persistence in your internal load balancer but doesn't work when you configure "Client IP" for session persistence.

More information on Azure load balancer session persistence:

https://video2.skills-academy.com/en-us/azure/load-balancer/distribution-mode-concepts#session-persistence

I checked internally and couldn't find any issue/bug with the Azure internal load balancer in terms of session stickiness when Client IP is configured for session persistency.

I also found that you've created a support request for this issue. It would be better to troubleshoot this issue over a remote session as the support engineer can look into your environment and collect required logs. So, I'll track the support request from my end and will add an answer once the root cause of the issue is found.

Regards,

Gita

@Prashant Gaur , on checking the support case, I found that you were able to resolve the issue by configuring SNAT for symmetric routing. Do let us know if you need further assistance on this issue. Thanks!