Asymmetric Routing (Firewall)

PeraHoman
PeraHoman used Ask the Experts™
on
Is it possible to have asymmetric routing from a stateful firewall?  The firewall will keep the connections in the state table, but it not the way its routed?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018
Commented:
It is not possible if you perform natting on firewall. How will device that receive packets know where is located source of the traffic since there is no NAT table?
Typically for asymmetric routing you need two connected firewalls.
Asymmetric Routing and Firewalls
Natting is done on the FW.  I was just wondering if this was possible.  

We see hits on our FW logs about traffic leaving our FW destined our Vendors public server, but there are no hits on return traffic from the Vendors server back to our FW.
Commented:
It's not possible for dynamic NAT but possible for static NAT. Unlike dynamic, where entries are created in xlate table for the current traffic going through, static NAT entries are added upon the configuration and work for any direction. So if you would have two ASA's with the same static NAT and ACLs and configured tcp state bypass, it would be possible for asymmetric routing to happen.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial