Asymmetric routing assistance

ciscojuniperf5 — Wed, 25 Jun 2025 18:35:05 GMT

I have a Meraki that has a SVI for vlan 5, 172.18.5.2 and it's trunk to a firewall that also has an SVI for vlan 5 172.18.5.1. There is a default route from Meraki pointing to 172.18.100.1 which is on the firewall. Meraki has an SVI 172.18.2.1. Server 172.18.5.76 is unable to reach IDRAC 172.18.2.75 via https though ANY is allowed on firewall. IDRAC and server are connected to switchports on Meraki. I have limited access to Palo Alto. I ran packet captures on Meraki switchports where firewall and IDRAC is connected, I see SYN and ACK but no SYN,ACK on the port where firewall is connected. Also on the switchport where IDRAC is connected, I see SYN and SYN,ACK but no ACK. 172.18.2.76 is accessible via https through VPN. Default gateway of Server is firewall 172.18.5.1 and for IDRAC it is the Meraki 172.18.2.1

This is because there SVI for VLAN 5 on the Meraki and there is an ARP for jumpbox on Meraki .So SYN-ACK is going from IDRAC to its gateway Meraki and from Meraki to jump box. So the firewall does not see the SYN-ACK and dropping the ACK.

I did a packet capture and we see ack on the drop stage on the firewall.

Will command 'set deviceconfig setting tcp asymmetric-path bypass' fix the issue

Re: Asymmetric routing assistance

mshekh — Thu, 26 Jun 2025 07:08:57 GMT

Hi @ciscojuniperf5 ,

Thanks for info, please run the packet capture and check the counter to understand the reason for drop. Based on that you can work to fix the issue.

As it's not necessary that traffic is getting dropped due asymmetric route.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0

topic Re: Asymmetric routing assistance in Next-Generation Firewall Discussions

Asymmetric routing assistance

Re: Asymmetric routing assistance