topic Re: not so asymmetric traffic in Firewall and Security Management

not so asymmetric traffic

Luis_Miguel_Mig — Wed, 22 Jun 2022 15:03:52 GMT

Assuming that anti spoofing is disabled, is there any issue if the gateways routes traffic towards a physical interfaces and the response returns to the same firewall on a different interface?
I am planning a migration and I could be in this scenario for a few minutes.
I was wondering if any security feature could be sensitive to this scenario or the gateway will just process the traffic.

Re: not so asymmetric traffic

Vladimir — Wed, 22 Jun 2022 16:00:41 GMT

I do not think that you will experience any issues besides warnings and all existing sessions being dropped until reconnected.

The only caveat is if you are using Zones and if both interfaces expected to carry asymmetric traffic are the members of the same zone.

Are you planning to disable anti-spoofing globally or in select interfaces' properties?

Better to get a second opinion here before trying though...

Re: not so asymmetric traffic

PhoneBoy — Wed, 22 Jun 2022 19:02:42 GMT

SecureXL will put the initial ingress/egress interfaces in the forwarding table and use that for all packets on the connection.
Not exactly sure what would happen if it receives a packet on the wrong interface.
I would test this in the lab to confirm it doesn't break anything.

Re: not so asymmetric traffic

Timothy_Hall — Fri, 24 Jun 2022 19:28:41 GMT

As long as the firewall is receiving both the c2s and s2c flow of packets and antispoofing is not violated, traffic coming back on a different interface than it left on will work to my knowledge. If one of the flows is bypassing the firewall completely that will not work.

Re: not so asymmetric traffic

Luis_Miguel_Mig — Tue, 05 Jul 2022 10:38:24 GMT

Thanks