topic Re: Asymmetric Routing and TCP syn check based on interface or zone? in General Topics

Asymmetric Routing and TCP syn check based on interface or zone?

ghostrider — Fri, 14 Oct 2016 12:33:06 GMT

Hello

I have scenario like firewall is connected to two routers R1 and R2 through eth1/1 and eth1/2 interfaces respectively. From firewall, traffic is going through R1 via eth1/1 interface and return traffic is coming through R2 via eth1/2.

This is asymmetric routing and firewall tcp syn check will fail. My question is that Palo Alto firewall check tcp syn and asymmtric routing based on interface or zone? I mean if both eth1/1 and eth1/2 have same zone then this will not fail tcp syn checking?

Regards,

Re: Asymmetric Routing and TCP syn check based on interface or zone?

licenselu — Fri, 14 Oct 2016 14:05:43 GMT

Hi,

In the ZONE Protection profile (TCP Drop), select Bypass for Asymmetric Path.

https://live.paloaltonetworks.com/t5/Management-Articles/Packets-are-Dropped-Due-to-TCP-Reassembly/ta-p/57139

Regards,

Re: Asymmetric Routing and TCP syn check based on interface or zone?

ghostrider — Sun, 16 Oct 2016 11:53:38 GMT

Thanks for the reply. Just want to know if I put both outoing interfaces interfaces in same zone then firewall will not drop asymmetric traffic?

Re: Asymmetric Routing and TCP syn check based on interface or zone?

pulukas — Sun, 16 Oct 2016 21:40:30 GMT

PA session match is based on zone not on interface. So you are correct that if you put both interfaces into the same zone you can still achieve session match and not drop the traffic.

You can see the details of the packet inspection process in this document.

https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081

Re: Asymmetric Routing and TCP syn check based on interface or zone?

ghostrider — Sat, 22 Oct 2016 14:21:01 GMT

Thansk steve !