Your stateful firewalls drop traffic when routing becomes asymmetric. Why, and how do you design around it?
Show the answer
Say this first
A stateful firewall only accepts packets that belong to a session it saw being created. If the SYN leaves through FW1 and the SYN-ACK comes back through FW2, FW2 has no session and drops it as out of state. The fix is either symmetric routing, so both directions of a flow cross the same firewall, or a cluster that shares state and forwards asymmetric packets to the member that owns the session. Turning off state checks is a last resort for specific flows only.
Go deeper
How it happens
Two internet edges, each with its own firewall. Inside, the gateway (HSRP) is active on side A, so traffic leaves via FW1. On the outside, ISP B advertises your prefix with a better path, so replies come back via FW2.
What it looks like on a Cisco ASA or Secure Firewall:
%ASA-6-106015: Deny TCP (no connection) from 192.0.2.80/443 to 10.10.10.51/51544 flags SYN ACK on interface outsideOn PAN-OS the global counters show non-SYN TCP packets dropped for having no session, for example
flow_tcp_non_syn_drop.
Design options
- Make routing symmetric. Align the inside gateway with the outbound path, steer inbound with BGP (AS path prepending, more specific prefixes on the preferred link), or run the pair active/standby so only one path is live.
- Share state. Clustered or active/active firewalls synchronize sessions and redirect a packet that arrives at the wrong member over a cluster link to the session owner. This needs low-latency links between members and adds complexity.
- Place the firewall where paths converge, for example behind both edge routers instead of one per edge.
- Bypass state checks for named flows, for example ASA TCP state bypass. You lose inspection for those flows, so keep it narrow and documented.
NAT makes symmetry even more important: the return packet must hit the same device that holds the translation.
They will ask next
How would you prove asymmetry is the cause?
Capture on both firewalls for one flow. FW1 shows the SYN going out and nothing coming back, FW2 logs a no-connection deny for the SYN-ACK. Then compare the routing tables and BGP paths in each direction, and run traceroutes from both ends.
Does asymmetric routing hurt networks without firewalls?
Plain routers do not care. Anything stateful does: NAT, IPS, load balancers, and strict uRPF, which drops packets that arrive on an interface that is not the best path back to the source.
Traps
- Disabling TCP state checking globally to "fix" the drops. That turns the firewall into a router with ACLs.