Redundant Paths to a single FW

Without knowing the full network architecture i cannot give you a full answer. If the firewalls are separate entities, I.E not in a cluster and not sharing session tables then I guess your main problem is each firewall will not know about current sessions for other firewall for the reply packets. You could source nat on the firewall to ensure that the session that the firewall was created on goes back through the correct firewall, but as mentioned need to know more details. Other questions pop into my head such as are the sessions load balanced on the routers(Equal cost paths) per packet or per destination etc...

Lee.

LEEroy
CCNP,CCIP

This is a single PaloAlto firewall. Two routed links in and one DMZ link. With VRRP at the user vlan each user is directed to one of two core routers as their gateway. The firewall has one routed link to each core router. So the user will always enter the firewall on a known inbound port. What we see is that the returning session from the server behind the firewall will not always come back out the same port it went in on. Hence the asymmetric route. Users fail intermittently with lose of connections. In general the consensus I've heard is that firewalls don't handle this kind of network topology very well. Two firewalls with one in standby is the answer. I am trying to see if this is the only answer or does someone have this working.

thnks
vnt90