topic Re: ASA session Check in Asymmetric Routing in Network Security

ASA session Check in Asymmetric Routing

amhish@netfox.de — Fri, 21 Feb 2020 17:15:46 GMT

I have a question regarding ASA session check

Imagen this situation

We have an ASA which is Building two VPNs (Site-to-Site) to the Cloud and in the Routing table there is a loadbalancing to the Destination in the Cloud over the two VPN connections.(Loadbalancing)

My question is lets if the first packet TCP,Syn sent over the first VPN and the answer TCP-ACK came over the second VPN will the ASA Drop this packet?

ofcourse considring RPF is not being violated.

Re: ASA session Check in Asymmetric Routing

Mike.Cifelli — Mon, 01 Jul 2019 13:24:12 GMT

Something to consider is using TCP state bypass for your specific (interesting) vpn traffic. This basically alters the way sessions are established. It is similar to how a UDP connection is treated. See: https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_tcpstatebypass.html#wp1088415

Re: ASA session Check in Asymmetric Routing

amhish@netfox.de — Fri, 05 Jul 2019 09:48:05 GMT

Thank you for your respond.

Looks like loadbalancing over tunnels will stay out of reach on ASA.

TCP Bypass ist not supported on Tunnel interfaces.

we will need to install a router infront of the Firewall.