echo reply Drop-reason: (inspect-icmp-seq-num-not-matched) ICMP Inspect seq num not matched

[junsung kim]

hi everyone

A routing flow is asymmetric.

A icmp request comes in another route.

Then icmp reply goes to ASA.

ASA forwards the packets from inside to inside by static route

I've used to tcp_state_bypass feature to clear this issue.

But icmp isn't successful.

If i disable 'inspect icmp' of global policy, ping is successful

Instead, ping from inside to outside isn't successful.

I don't know how to handle this.

thank you

best regards

[Mohammed al Baqari]

You need to fix your routing. Why are you using asymmetric routing,? Is
this by design ?

[junsung kim]

Hi

this is by design.

i'm going to suggest topology change.

But i want to know how i can fix it without topology change.

thank you

best regards

[panoschatz]

Hi all,

we have exactly the same issue.

Asymmetric routing by design.

Resolved tcp connectivity with tcp_state_bypass, but we have problem with icmp (ICMP Inspect seq num not matched).

Opened ticket with TAC and the response was to disable icmp inception and allow traffic to Access Control Policy.

Is this solution correct from security perspective, since icmp inspection is global to the FTD?

Is there another better solution?

Thank you.