What is asymmetric routing, and why does it break stateful firewalls?
Show the answer
Say this first
Asymmetric routing means a flow goes out one path and comes back another. Routers do not mind, since they forward each packet on its own. A stateful firewall does: it creates a session when it sees the SYN and only passes return traffic that matches. If the SYN goes through firewall A and the SYN-ACK returns through firewall B, B has no session and drops it. Symptoms: TCP connections time out while ping may work, and the firewall logs drops for packets with no connection.
Go deeper
How it happens
- Two internet or WAN links where outbound follows one default route and inbound arrives on the other.
- Two data centers, each with its own firewall, advertising the same prefix.
- HSRP active on one switch while the firewall's route back points at the other.
- A new link or metric change that moves only one direction.
Who cares about asymmetry
| Device | Effect |
|---|---|
| Router | none; each packet is routed on its own |
| Stateful firewall | drops return or mid-flow packets of sessions it never saw |
| NAT device | return traffic arrives where no translation exists |
| IPS, some load balancers | see half a conversation and cannot track it |
A Cisco ASA logs these as %ASA-6-106015: Deny TCP (no connection) messages.
Detecting it
- Traceroute from each end toward the other, and compare.
show ip routefor the destination on the outbound side and for the source on the return side.- Capture on both paths: the SYN on one, the SYN-ACK on the other.
Fixing it
Make the paths symmetric: BGP local preference and AS path prepending or MED, IGP metrics, an FHRP aligned with the firewall's route, or source NAT on the firewall so replies must come back to it. A firewall cluster that shares state across both paths also works. TCP state bypass gives up inspection for that traffic, so it is a documented exception, not a fix.
They will ask next
Is asymmetric routing always a problem?
No. The internet is full of it and routers handle it fine. It breaks only devices that keep per-flow state: firewalls, NAT, IPS and some load balancers.
How does source NAT fix asymmetry?
The firewall rewrites the source to its own address, so the server replies to an address that only routes back through that firewall. The cost is that the server no longer sees the real client IP.
Traps
- Disabling stateful inspection globally to "fix" it.