Network & Infrastructure / IPv6, TCP & Transport Engineering
Asymmetric routing and reverse-path checks on multihomed edges
A valid packet arrives over a secondary provider and is dropped before reaching the application. Strict reverse-path validation may expect the source through another interface.
Environment and inputs: Dual-stack routed networks and transport endpoints; validate the complete path and the active operating-system version. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record the ingress interface, best reverse route, source prefix legitimacy and filtering mode. Compare stateful-firewall symmetry requirements separately from router source-validation behavior.
Explain the result
Strict reverse-path checks assume a particular relationship between incoming traffic and the reverse route. Legitimate multihoming can violate that assumption without indicating spoofing.
Plan the fix
Select source validation appropriate to the approved asymmetric topology, using feasible-path or scoped policy where supported. Preserve anti-spoofing at boundaries rather than disabling validation indiscriminately.
Check the result and rollback
Test legitimate asymmetric flows and spoofed source examples in a controlled environment. Revert if the new policy accepts unauthorized sources or breaks required return traffic during failover.