cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
578
Views
0
Helpful
2
Replies
Highlighted
Beginner

When switching to asymmetric mode - what functionality is lost?

Hello,

I'm working on a IPS design in a fully redundant DC that is almost impossible to force symmetrical flows.  My question is when using assymetric mode for TCP reassembly - what exactly is lost?  Below is the list I've come up with so far:

1.  TCP Normalization.  (No big deal in my case because the ASA provides alot of this same functionality)

2.  Anomaly Detection.  With assymetric mode this should be set to Inactive.

I'm also including a diagram that depicts my situation.

2 REPLIES 2
Beginner

Re: When switching to asymmetric mode - what functionality is lo

Hi.

don't forget that if the IPS sees half of the traffic, and if the attack pattern is in the other half that the IPS doesn't see, then of course the sensor can't detect the attack.

so asymetric traffic lowers the effectivness of the IPS, and makes it unreliable in always detecting the attacks it should. also attack patterns spread across several tcp segments might not be detected. if one segment is seen by the IPS while another is not.

Regards,

Fadi.

Beginner

Re: When switching to asymmetric mode - what functionality is lo

Hi Fadi,

Thanks for the response.  In our design, the only time we would really see asymmetric traffic is if one of the 4270's link's went down.  If we lose an entire 4270 we are still ok - just an individual link is when we could encounter asymmetric flows.  I'd really like to design around that, but it seems the only way would to have a services block layer where via STP we can rely on the traffic always going to one switch.  vPC with all it's benefits does lose you a predictable traffic path.

Brad

CreatePlease to create content
Content for Community-Ad
FusionCharts will render here