nerdexam
Cisco

300-320 · Question #59

Which option prevents the dropping of asymmetrically routed packets in active/active failover paired firewalls?

The correct answer is C. Assign similar interfaces on each firewall to the same asymmetric routing group. Assigning interfaces on both firewalls to the same asymmetric routing (ASR) group allows the standby unit to forward return traffic correctly when packets arrive on a different unit than the one that saw the outbound flow.

Security Services

Question

Which option prevents the dropping of asymmetrically routed packets in active/active failover paired firewalls?

Options

  • ANothing can be done to prevent this from happening.
  • BConfigure different policies on both firewalls.
  • CAssign similar interfaces on each firewall to the same asymmetric routing group.
  • DAssign similar interfaces on each firewall to a different asymmetric routing group.

How the community answered

(28 responses)
  • A
    4% (1)
  • B
    7% (2)
  • C
    75% (21)
  • D
    14% (4)

Why each option

Assigning interfaces on both firewalls to the same asymmetric routing (ASR) group allows the standby unit to forward return traffic correctly when packets arrive on a different unit than the one that saw the outbound flow.

ANothing can be done to prevent this from happening.

ASR groups on Cisco ASA active/active failover are specifically designed to handle asymmetric routing, so the problem is preventable.

BConfigure different policies on both firewalls.

Configuring different policies on each firewall does not resolve the state mismatch problem caused by return traffic arriving on the wrong unit.

CAssign similar interfaces on each firewall to the same asymmetric routing group.Correct

On Cisco ASA in active/active failover, asymmetric routing groups (ASR groups) enable the firewall that receives the return packet to redirect it to the unit that owns the connection state, preventing the packet from being dropped. Both similar interfaces must share the same ASR group number so they can communicate connection state for asymmetrically routed flows. Without this, the unit that never saw the outbound connection will drop the return packet as unsolicited.

DAssign similar interfaces on each firewall to a different asymmetric routing group.

Assigning interfaces to different ASR groups means the two units cannot share connection state for those interfaces, which worsens the problem rather than resolving it.

Concept tested: ASA active/active failover asymmetric routing groups

Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/configuration/general/asa-914-general-config/ha-failover.html

Topics

#asymmetric routing#active/active failover#firewall high availability#asymmetric routing group

Community Discussion

No community discussion yet for this question.

Full 300-320 Practice