300-320 · Question #59
Which option prevents the dropping of asymmetrically routed packets in active/active failover paired firewalls?
The correct answer is C. Assign similar interfaces on each firewall to the same asymmetric routing group. Assigning interfaces on both firewalls to the same asymmetric routing (ASR) group allows the standby unit to forward return traffic correctly when packets arrive on a different unit than the one that saw the outbound flow.
Question
Which option prevents the dropping of asymmetrically routed packets in active/active failover paired firewalls?
Options
- ANothing can be done to prevent this from happening.
- BConfigure different policies on both firewalls.
- CAssign similar interfaces on each firewall to the same asymmetric routing group.
- DAssign similar interfaces on each firewall to a different asymmetric routing group.
How the community answered
(28 responses)- A4% (1)
- B7% (2)
- C75% (21)
- D14% (4)
Why each option
Assigning interfaces on both firewalls to the same asymmetric routing (ASR) group allows the standby unit to forward return traffic correctly when packets arrive on a different unit than the one that saw the outbound flow.
ASR groups on Cisco ASA active/active failover are specifically designed to handle asymmetric routing, so the problem is preventable.
Configuring different policies on each firewall does not resolve the state mismatch problem caused by return traffic arriving on the wrong unit.
On Cisco ASA in active/active failover, asymmetric routing groups (ASR groups) enable the firewall that receives the return packet to redirect it to the unit that owns the connection state, preventing the packet from being dropped. Both similar interfaces must share the same ASR group number so they can communicate connection state for asymmetrically routed flows. Without this, the unit that never saw the outbound connection will drop the return packet as unsolicited.
Assigning interfaces to different ASR groups means the two units cannot share connection state for those interfaces, which worsens the problem rather than resolving it.
Concept tested: ASA active/active failover asymmetric routing groups
Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/configuration/general/asa-914-general-config/ha-failover.html
Topics
Community Discussion
No community discussion yet for this question.