The security administrator has just installed an active\passive cluster of two firewalls for enterprise perimeter defense of the corporate network. Stateful firewall inspection is being used in the…

Question

Options

• ATCP sessions are traversing one firewall and return traffic is being sent through the secondary firewall
• BTCP and UDP sessions are being balanced across both firewalls and connections are being dropped
• CPrioritize UDP traffic and associated stateful UDP session information is traversing the passive firewall
• DThe firewall administrator connected a dedicated communication cable between the firewalls in order

• A
  45% (21)
• B
  32% (15)
• C
  17% (8)
• D
  6% (3)

Explanation

In an active/passive cluster, only the active node processes traffic while the passive node stands by. Stateful firewall inspection maintains a session state table tracking TCP connection states (SYN, ESTABLISHED, etc.) for each active flow. If the session state table is not synchronized between the two nodes, inbound packets returning from an external client may arrive at the passive firewall (due to asymmetric routing) which has no record of the original outbound TCP session. Because the passive firewall sees no matching state entry, it drops the return traffic as unsolicited, causing connection failures. The fix is to enable state synchronization between the cluster nodes.

No community discussion yet for this question.