topic Re: How will threat functionality work with asymmetric routing in Advanced Threat Prevention Discussions

How will threat functionality work with asymmetric routing

SuryaR — Mon, 14 Jan 2019 18:37:42 GMT

I would like to understand what will happen to Threat Protection and AntiVirus(TPAV) in the following case. Both firewalls have "allow" non-syn-tcp turned on. Each firewall is only seeing half of the session and has no idea about the other half.

My questions is will Palo be able to detect any threats or vulnerabilities, (or) does it need to see a bi-directional flow/session to kick in TPAV parameters.

Please let me know for any questions in case I am not clear.

Re: How will threat functionality work with asymmetric routing

OtakarKlier — Thu, 17 Jan 2019 22:55:51 GMT

Hello,

Is there a reson you are not running HA? Doing this might resolve your issue and keep your network flowing correctly.

Regards,

Re: How will threat functionality work with asymmetric routing

mivaldi — Thu, 17 Jan 2019 23:03:24 GMT

The way it's currently implemented, it won't be able to detect threats.

You need to change the configuration to Active-Active HA, this is the scenario that Active-Active is designed to resolve.