Source and classification
- Source: ZNS Network Service 1.2.0 known limitation.
- Classification: Known limitation.
- Confirmation basis: This cross-tier, same-segment topology is outside the currently supported scope.
Issue metadata
- Issue ID: ZCF-4471.
- Component/product: Network Service and DNAT-LB.
- Status: Closed.
- Priority/severity: P1.
- Affected version: 1.2.0.
- Resolution: No fix is planned. It is recommended to adjust the topology according to the workaround.
Problem description
When a DNAT-LB at a Tier-0 service entry points to a Tier-1 backend and the Tier-0 external network and Tier-1 service network are on the same segment/CIDR, the TCP three-way handshake may fail while UDP may remain functional. This topology is outside the supported scope of the current version. It is recommended to adjust the network topology to avoid the issue.
Symptoms
- A TCP connection cannot complete the three-way handshake.
- UDP traffic may work with the same topology.
- Testing only UDP may lead to the incorrect conclusion that the path is available.
Impact
TCP services cannot establish connections, and inconsistent results between protocols may make troubleshooting more difficult.
Workaround
- Avoid this cross-tier topology.
- Ensure that the gateway that owns the DNAT/LB can directly reach the backend.
- Separate the Tier-0 and Tier-1 service networks and confirm that return routing is symmetric.
- Validate both TCP and UDP. Do not determine that the path is normal based on the result for only one protocol.
Affected products
- Product: ZCF.
- Component: Network Service.
- Version: 1.2.0.
Fix status
- Current status: No fix is planned.
- Related patch/fix package: None.