topic Re: Issues with Asymetric Routing in General Topics

Issues with Asymetric Routing

Apadilla — Thu, 01 Oct 2015 16:12:34 GMT

Hello Community,

I need your help to how to identify the asymetric routing in my PA-3020? and what are the best way to allow or bypass these traffic until solve the routing issue the third party device?.

Best Regards

Andres Padilla

Re: Issues with Asymetric Routing

glastra1 — Thu, 01 Oct 2015 16:57:53 GMT

Depending on what assimetric routing the firewall is seeing, the most agressive/global is

set session tcp-reject-non-syn no

You can also add a a Zone protection profile in this one select "packet based attack protection", uncheck mismatched overlapping TCP segment, reject non-syn tcp: no, asymetric path: bypass. And attach it to the zone where the assimetric traffic is arriving.

regards,

Gerardo

Re: Issues with Asymetric Routing

Apadilla — Thu, 01 Oct 2015 17:10:04 GMT

I set up a protection zone the following way.

And assinged to untrust zone.

After performed this change I see the

the numer 51303508 not changed.

flow_tcp_non_syn_drop 51303508 0 drop flow session Packets dropped: non-SYN TCP without session match

But this number always increase 51316034.

flow_tcp_non_syn 51316034 4 info flow session Non-SYN TCP packets without session match

Re: Issues with Asymetric Routing

pankaku — Thu, 01 Oct 2015 22:37:55 GMT

To identify the asymmetric routing issue one of the possible way is to do a ping from a host and then check if the s2c byte are 0 or not if the s2c are 0 and ping is sucessful then reply is not comint through firewall

Refer to following document for non syn packets

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Set-the-Palo-Alto-Networks-Firewall-to-Allow-non-Syn/ta-p/62868

Re: Issues with Asymetric Routing

santonic — Fri, 02 Oct 2015 07:12:33 GMT

the numer 51303508 not changed.

flow_tcp_non_syn_drop 51303508 0 drop flow session Packets dropped: non-SYN TCP without session match

But this number always increase 51316034.

flow_tcp_non_syn 51316034 4 info flow session Non-SYN TCP packets without session match

That means you are no longer dropping asymmetric TCP sessions, but there are still such sessions happening. Now you have to resolve your routing and when both counters stop increasing you know you don't have any asymmetric routing any longer. Then start dropping non-SYN sessions again.