RBR-850 v4.6.3.9 - Change in behavior.

RBR-850 / AX6000

Noticed an issue a few weeks ago attempting to SSH to a device that is located over a VPN tunnel. This had been working previously and it wasn't a big deal because the site had already been configured to allow client VPN and it's a low touch environment so I wasn't all that concerned. Being a network guy though this was like a splinter irritating my brain that i had to work out.

So, I started doing some testing.

The VPN peer tunnel interface IPs are on 10.255.255.0/30 my local is .1 and the far end is .2

Local access is 10.1.0.0/24 - my client is DHCP, the gateway is .1 and my VPN appliance is .2

I can ssh to the vpn appliance at 10.1.0.2 just fine and from there I can use ssh to ssh to the far end vpn appliance at 10.255.255.2

Going further i can ssh to 10.20.0.1, and address on the remote side of the tunnel from the local vpn device.

When I attempt to ssh to 10.20.0.1 from my local endpoint, the traffic goes to my default gateway (10.1.0.1, where a static route is entered and directs the traffic to 10.1.0.2 - I get an initial SSH prompt for my login name, and then the traffic times out. This happens every time.

Ok, so i can get there from the VPN device but not my enpoint, both are on the same network.... what changed? I looked at the uptime om my RBR-850 it was 2 days, and a new firmware had just recently been released, which it had automagically upgraded to....

Ok, so lets take the RBR out of the mix with a static route from my endpoint.... so I added a route table entry in my local endpoint that sends 10.20.0.0/24 to 10.1.0.2 and fired up an SSH attempt to 10.20.0.1 - it completed flawlessly.

Great, so the router changed behavior with the new version. Examining the release notes however there was nothing that would indicate a change in behavior for async traffic flows (the flow would be async because the return traffic would egress out the local VPN device without having to hit the router as it would arp for the client being on the same network and all) or static routes. Ok well, I'll just downgrade to the previous version - but no, it looks like that is prevented. So I'm stuck here with a very expensive product that no longer functions the way i need it to....

Please fix this firmware to restore this lost functionality.