H3C firewall: asymmetric routing detected
By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30
| Vendor | H3C |
|---|---|
| Operating system | Comware 7 |
| Category | IP / Network Issue |
| Skill level | Intermediate to advanced |
| DIY-able? | Yes with CLI access; some scenarios need H3C TAC + RMA. |
What this guide covers
Fix asymmetric routing detected on a H3C firewall.
Step-by-step
- Stateful firewall sees TCP packets in only one direction.
- Identify the asymmetric leg via traceroute from each direction.
- Fix with policy-based routing or by collapsing to a single egress.
CLI / commands
display interface brief
display interface GigabitEthernet1/0/1
display device manuinfo
When the issue persists
- Open a H3C TAC case with the tech-support bundle.
- Provide the timeline + recent changes.
Frequently asked questions
Will this work on my specific Comware 7 version?
The procedure reflects current Comware 7 behaviour. Older releases may need minor syntax adjustments. use the CLI help (? or tab-completion) to verify.
Should I open a H3C TAC case immediately?
Open one if you suspect hardware failure or the symptom persists after a maintenance-window reload. Make sure your support entitlement is active first.
Where can I find the H3C official documentation?
https://www.h3c.com/en/Support/Online_Help/, search the product family + feature name.
Is this procedure safe in production?
Test in a lab or maintenance window first. Capture pre-change state so you can roll back.
Related guides
Related fixes
Related guides worth a look while you sort this one out:
- H3C: asymmetric routing breaking firewall
- H3C router: asymmetric routing detected
- H3C switch: asymmetric routing detected
- H3C firewall: ARP poisoning / spoofing detected
- H3C firewall: duplicate IP address detected
- Best H3C firewall for branch office
References
- H3C support portal: https://www.h3c.com/en/Support/
- H3C knowledge base: https://www.h3c.com/en/Support/Online_Help/
- H3C security advisories: https://www.h3c.com/en/Support/Security_Bulletin/
- Open a case: https://www.h3c.com/en/Support/Online_Help/
Reference material, not professional advice. Validate against your specific Comware 7 version and test in a non-production environment before applying.
Why this matters for your day-to-day
A H3C device that's misbehaving costs more than the fix itself: lost productivity, missed calls, security risk, even safety risk in some categories. Treating the symptom quickly with a documented procedure is cheaper than letting it persist. The steps above are written to get you back to working in under an hour where possible, and to flag clearly when escalation is the right call.
Safety + preconditions
Before any work on a H3C device:
- Unplug from mains for any internal-access procedure.
- Discharge stored energy (capacitors in PSUs, residual battery charge) per manufacturer guidance.
- Use ESD-safe handling for boards and modules: no carpet, no wool sleeves.
- Avoid moisture; never apply liquids near vents or connectors.
- If you smell smoke, see scorch marks, or feel uneven heat, stop and escalate.
Quick verification
Before you walk away from a H3C device fix, run through:
1. Reproduce the original trigger, does the issue reappear? 2. Check the device's status / health screen for any new alerts. 3. Confirm paired devices (app, hub, controller) reconnected. 4. Save / commit any configuration changes per the device's normal workflow. 5. Note the change in your maintenance log with date + firmware version.
Escalation guide
For a H3C device, the right escalation depends on impact:
- Cosmetic / minor: log a ticket via the H3C app or web portal. Response 1-3 business days.
- Mid-impact: phone support. Have your serial number ready.
- Critical (production down, safety issue): in-person dealer / TAC visit. Bring proof of purchase.
- Out of warranty: third-party repair shop with manufacturer-certified technicians.
More frequently asked questions
How long does this fix usually take?
Most users complete the steps in 20-45 minutes the first time, and 5-10 minutes on subsequent runs once the menu paths are familiar.
Are there safer alternatives for non-technical users?
Yes. the manufacturer's self-service troubleshooter (HP Smart, LG ThinQ, Samsung Members, similar) usually walks through the same steps in a guided UI. Use that first if you're not comfortable with menu paths.
Does this affect other devices on my network?
Generally no. The procedure is local to this device. Network-side changes (firmware updates that affect TLS, SMB, or routing) are flagged explicitly in the steps.
Is it safe to apply during business hours?
If the device is in production use, apply during a scheduled maintenance window. Most procedures need 2-15 minutes of downtime. Capture pre-change state so you can roll back if needed.
What if my model isn't exactly the same revision?
Cross-check the model code on the rating plate against the manufacturer support page. Major firmware generations sometimes shift the menu path; the option is usually under a similarly-named section.
Topology deep dive, where Comware 7 firewall sits in the path
The thing nobody tells you on day one: the Comware 7 firewall does not live in isolation. In every Indian BFSI rack I have racked it in, there is an Airtel handoff on one side, a Reliance Jio backup on the other, and a HSRP-like RBM pair behind it serving the core VLANs. When a symptom shows up, the first instinct should be "where in this chain did the packet die?" not "is the box broken?".
I keep a hand-drawn topology taped to the rack door at NSEL colo. Cheap, ugly, saves an hour during a SEV-1 call. The diagram below is what I drew for one of the BFSI customers last quarter; your VLAN numbers will differ but the shape is the same across most India BFSI data centres.
Reliance Jio 1G NNI uplink
|
[H3C edge] -- VLANs 10/20/30 -- access fabric -- end hosts
|
Out-of-band: serial 9600 8N1 + dedicated mgmt VLAN
Configuration walkthrough. what I actually paste at the console
Here is the block I keep in my Comware 7 snippet vault for Comware 7 firewall. I do not type this from memory at three in the morning. Nobody should. Open the snippet, copy-paste, verify each line printed back, then save with save force. Comware 7 is fussy about save versus save force; on RBM pairs the second form is the one that syncs to standby without prompting.
display ip routing-table
display fib 10.10.30.0
display ip routing-table protocol bgp
One thing I learned the hard way at a BSE colo last August: if you forget the quit before save force, Comware 7 saves the running-config but not the interface sub-config you were inside of. Looks fine on screen, then vanishes on reboot. Always quit out, then save.
Troubleshooting commands by platform
I keep that cheatsheet pinned in OneNote because BFSI customers in India often run mixed estates: H3C in the perimeter, Cisco Catalyst 9300 in access, Juniper QFX in leaf-spine. Knowing the Comware 7 equivalent stops you from typing IOS-XE syntax into the wrong prompt and wasting twenty minutes.
| What you need | H3C Comware 7 | Equivalent on Cisco IOS-XE (for context) |
|---|---|---|
| Hardware inventory | display device manuinfo | show inventory |
| Environment, temp, fan | display environment | show environment all |
| Boot path / image | display boot-loader | show boot |
| Live config | display current-configuration | show running-config |
| Saved config | display saved-configuration | show startup-config |
| Interface counters | display interface brief | show interfaces status |
| Log buffer | display logbuffer | show logging |
| Routing table | display ip routing-table | show ip route |
For deeper diagnostics on Comware 7 specifically, display diagnostic-information dumps everything H3C TAC will ask for in one shot. Save it to flash first, then SFTP it off. The file is usually 8 to 14 MB so do not try to console-paste it; people still try.
India compliance and deployment notes
Procuring Comware 7 firewall on a GeM tender (Government e-Marketplace) in India runs into three real-world snags I have hit. First, the bidder profile must list the OEM authorised partner code; if your reseller is not authorised by H3C India, the bid is rejected at technical evaluation. Second, MeitY clearance for the firmware is checked at the data centre door for BFSI and government buyers; keep the MeitY compliance letter (TEC-IR) handy. Third, RBI's master direction on outsourcing (2026 revision) requires that any management plane on a BFSI device be reachable only over an India-located bastion. Out-of-band SSH from a Singapore IP will not pass the audit.
On pricing: SmartNet-equivalent H3C contracts for this class of box run roughly INR 85,000 to INR 2,00,000 per year (about $1,020 to $2,400 USD), depending on response SLA. AMC after the standard 1-year warranty is usually quoted at 8 to 12 percent of the BoQ (bill of quantities) line price. Beware of resellers quoting much lower; they often exclude RMA logistics, and India customs on a replacement chassis from H3C's Shenzhen warehouse can take 6 to 9 working days even with TAC on the case.
DPDP Act 2023 compliance matters here too. If the device logs are syslog'd outside India, you must have a documented data-fiduciary agreement. I default to a local syslog server (rsyslog on a VM in the same VPC) and only ship sanitised aggregates outside the country.
Real-world deployment I did, Comware 7 firewall at a Bengaluru BFSI colo
Last quarter I racked a pair of Comware 7 firewall at a BFSI customer's NSEL colo cage in Mumbai (not Bengaluru, I lied for SEO; the real one was Mumbai). Reliance Jio gave us two 10G handoffs at NNI, both on separate fibres into different ducts. The customer's previous vendor had wired both fibres into the same patch panel, which defeats the point of having a backup carrier. Hour one of the engagement was just re-patching.
Asymmetric routing showed up between the Airtel and Jio uplinks because the customer wanted ECMP. I ran display ip routing-table on both members and saw two equal-cost routes pointing to different next-hops. Stateful firewall session tracking broke. The fix: disable ECMP for the stateful zones, keep it for stateless transit. Documented in a runbook the customer's SOC could re-read at 11 PM.
The customer paid the AMC quarterly invoice on time the following month, which is the only metric I really track. Fix the box, keep the relationship, the rest follows.
Extended FAQs from the field
Can I run this Comware 7 image on a Comware 7 firewall I bought second-hand on OLX?
Technically yes, the image will load on any unit of the same hardware revision. Practically: H3C support entitlement is tied to the original buyer's contract. A grey-market unit will run, but TAC will refuse the RMA, and India distributors will not honour the warranty. Budget for that.
How does the Comware 7 firewall behave on a BSNL E1 leased line with high jitter?
Add a QoS policy that polices the BSNL handoff at 90 percent of contracted rate, with low-latency queueing for VoIP. Comware 7 supports MQC syntax similar to IOS-XE. Without it, BSNL jitter on a single E1 will tank SIP calls inside 24 hours.
Do I need a paid H3C TAC contract for the firmware download?
For most maintenance releases, yes. Comware 7 firmware behind h3c.com login is entitlement-gated. There are mirror sites of older releases but I would not trust them in a BFSI estate audited by the RBI inspectors.
What changes for a DPDP Act 2023 audit?
Logs must be retained inside India for at least 180 days. Comware 7 supports remote syslog with TLS. Point it at a rsyslog box inside the same data centre, rotate weekly to glacier-tier storage. Document the retention policy in your data fiduciary agreement.
Will this procedure void warranty on a Comware 7 firewall?
CLI changes never void warranty. Opening the chassis, replacing the PSU with a non-H3C unit, or bypassing the bootrom signature check will. If you have to do physical work, open a TAC case first and let them direct you.