MNHA: Asymmetric Traffic Flow

SRX Series Firewalls in Multinode High Availability support asymmetric traffic flows. While performing deep packet inspection or stateful firewall activity, it is a must that the firewall in the return path have the same state information associated with a packet flow as the state information is built in the originating firewall. To handle asymmetric traffic flows, the Multinode High Availability requires an additional link known as Inter Chassis Datapath (ICD). ICD has the ability to route the traffic between two nodes. It enables 209 the nodes to redirect asymmetric traffic flows to the peer node that is originally in charge of providing stateful services for these flows. This feature ensures the completion of TCP security check (such as three-way handshake and sequence check with window scale factor) for asymmetric traffic flows, thereby enhancing the performance and reliability of the network.