An engineer receives reports from users that applications are not working and that websites are only partially loading in an asymmetric environment. After investigating, the engineer observes the…

Question

Options

• Aset deviceconfig setting tcp asymmetric-path drop
• Bset session tcp-reject-non-syn yes
• Cset deviceconfig setting tcp asymmetric-path bypass
• Dset deviceconfig setting session tcp-reject-non-syn no

• A
  14% (5)
• B
  8% (3)
• C
  3% (1)
• D
  75% (27)

Explanation

To work around this issue, one possible troubleshooting command is set deviceconfig setting session tcp-reject-non-syn no which disables TCP reject non-SYN temporarily (until reboot)4. This command allows non-SYN first packet through without dropping it. The flow_tcp_non_syn_drop counter increases when the firewall receives packets with the ACK flag set, but not the SYN flag, which indicates asymmetric traffic flow. The tcp-reject-non-syn option enables or disables the firewall to drop non-SYN TCP packets. In this case, disabling the tcp- reject-non-syn option using the "set deviceconfig setting session tcp-reject-non-syn no" command can help work around the issue. This allows the firewall to accept non-SYN packets and create a session for the existing flow.

No community discussion yet for this question.