nerdexam
CompTIA

CAS-002 · Question #281

The security administrator has just installed an active\passive cluster of two firewalls for enterprise perimeter defense of the corporate network. Stateful firewall inspection is being used in the…

The correct answer is A. TCP sessions are traversing one firewall and return traffic is being sent through the. In an active/passive stateful firewall cluster, asymmetric routing causes dropped connections when TCP session state exists only on one firewall and return traffic arrives at the other. The firewall with no matching session entry drops the packets.

Technical Integration of Enterprise Components

Question

The security administrator has just installed an active\passive cluster of two firewalls for enterprise perimeter defense of the corporate network. Stateful firewall inspection is being used in the firewall implementation. There have been numerous reports of dropped connections with external clients. Which of the following is MOST likely the cause of this problem?

Options

  • ATCP sessions are traversing one firewall and return traffic is being sent through the
  • BTCP and UDP sessions are being balanced across both firewalls and connections are
  • CPrioritize UDP traffic and associated stateful UDP session information is traversing the
  • DThe firewall administrator connected a dedicated communication cable between the firewalls

How the community answered

(42 responses)
  • A
    55% (23)
  • B
    5% (2)
  • C
    26% (11)
  • D
    14% (6)

Why each option

In an active/passive stateful firewall cluster, asymmetric routing causes dropped connections when TCP session state exists only on one firewall and return traffic arrives at the other. The firewall with no matching session entry drops the packets.

ATCP sessions are traversing one firewall and return traffic is being sent through theCorrect

Stateful inspection firewalls maintain a session state table per device. In an active/passive cluster without session state synchronization, if outbound TCP traffic establishes a session on the active firewall but return traffic routes back through the passive firewall, the passive device has no matching session entry and drops the packets. This asymmetric traffic flow is the most common cause of dropped connections in such deployments.

BTCP and UDP sessions are being balanced across both firewalls and connections are

Active/passive clusters do not simultaneously load-balance sessions across both firewalls - only one is active at a time, so sessions cannot be split across both in normal operation.

CPrioritize UDP traffic and associated stateful UDP session information is traversing the

UDP is connectionless and stateful UDP tracking is less common; prioritizing UDP would not explain dropped TCP connections, which are the typical reported symptom.

DThe firewall administrator connected a dedicated communication cable between the firewalls

A dedicated communication cable between firewalls serves as a state synchronization link, which would help prevent dropped connections by replicating session tables - it is a solution, not a cause of the problem.

Concept tested: Stateful firewall clustering and asymmetric routing

Source: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/108802-asa-failover-config.html

Topics

#stateful firewall#HA cluster#session state#perimeter defense

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice