tcp bypass vs asr-group

[ambi]

I am a bit confused on the usage of these two features on the ASA

are they meant to achieve the same thing ...

if they differ can someone highlight their use with any example

thanks

Ambi

[Panos Kampanakis]

There are differnt features.

TCP state bypass doesn't check the state of a TCP connections. For example if you see a packet that doesn't correspond to the sequence number expected for the TCP conn, the firewall will not drop it like it would do normally.

The ASR groups are for a similar issue but in Activeve/Active failover. If a packet leaves one unit but the response comes back through the peer unit the ASR group will allow it even though normally the other unit didn't know about the connection and would have dropped it.

So, they practically correspond to a similar issue but they are different features.

I hope it helps.

PK