Load balancing multipath and online banking

Question

Since installing our XG125 our users have been having intermittent issues with online banking services. They would work one day but not the next, a reboot of the XG would fix things temporarily, but the problem always come back (HTTPS scanning is off, btw). 
 After spending lots of time troubleshooting I have a theory about what is happening, but would like to know if someone can confirm. 
 We have two WAN connections (2M SDSL/4M Fibre) and the XG is load balancing between them, as was our previous appliance, a Cisco SA-540. I think that the XG may be splitting traffic for a given user between both connections and that this is causing SSL/HTTPS problems with the banking sites. I have set up a test user with a network policy excluding them from load balancing and the issue seems to have gone away for that user. 
 What I would like to know: is it possible to set load balancing to act at a host level rather than a traffic level? That is to say balance the LAN IPs accessing the internet across both WANs, but not split the traffic from each host? It would seem that this was how the Cisco used to work since we never had issues with online banking before. 
 Any help would be greatly appreciated, thanks in advance! 
 Simon

sachingurung · Accepted Answer

Hi Simon, 
 Banking websites have secure communication and expect connection requests on an established session from a specific IP address. While load balancing, such traffic gets connection problem. To avoid this situation we configure a workaround to route such traffic through an FQDN rule. 
 The issue is a known bug NC-9349 and NC-9892, during load balance, sticky session method is not achieved. 
 Thanks

sachingurung · Answer

Hi Ronak, 
 It was fixed in the v17 Beta release but it is by default disabled. I was not able to find the information added in the release notes; I will check why with the concerned team over this. 
 You can take SSH to the XG and run the following command in Device Console, 
 console> set routing wan-load-balancing session-persistant connection-based ip-family all 
 Let me know if that helps. 
 Thanks

sachingurung · Answer

Hi Simon, 
 You can refer this KBA to configure FQDN based firewall rule. Select a specific primary gateway to route all the requests for FQDN host.

Aditya Patel · Answer

Hi RodrigoMendes , 
 It should be included in V17 Beta 1 Version.

talex · Answer

Ronak Sheth said: 
 Can you provide me with the release notes as I am not able to find bug resolution fror this issues in v17, MR1, or MR2. 
 
 Hi Ronak, 
 the issue is tracked internally in two tickets. One for v15 (NC-9349) which is rejected as we are now on v17.0. The other one is NC-9892 which was a feature improvement and never made it on the changelog. I can confirm that this was merged into SF 17.0 Beta1 (17.0.0.32).