Allow Asymmetric Routing on ASA

[Ronit Bhattacharjee]

We have a situation as the attached image.

Forward flow : Traffic comes in on Port 1 and leaves Port 3

Reverse flow : Traffic comes in on Port 3 and leaves Port 2

As you see, there's asymmetry here and the ASA is dropping this flow. Is there a way to override this behavior and excuse this traffic using any commands?

[Rob Ingram]

Hi @Ronit Bhattacharjee 

Try TCP state bypass, example here.

HTH

[Karsten Iwen]

First I would try everything to change the network implementation to remove the asymetry. If that all does not work, you can configure state bypass on the ASA. I would always see that as the last resort.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/111986-asa-tcp-bypass-00.html

[ngkin2010]

Since the asymmetry route is happening on the same ASA, you may consider to configure a traffic zone to 'bundle' port1 & port2.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/interface-zones.html