top of page
Search

Asymmetric Routing: two captures When SYN Leaves One Firewall and SYN-ACK Hits Another

  • 3 days ago
  • 2 min read
SOC / packet analysis network security troubleshooting lab
SOC / packet analysis · Techclick CLI troubleshooting lab
SYN leaves FW-A. SYN-ACK arrives on FW-B. Session never forms. Both firewalls are 'in path' on paper.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on SOC / packet analysis for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Stateful firewalls drop the stray SYN-ACK. Draw both directions. Fix routing or enable state sharing. Do not add more allows.

Why this ticket shows up

Return traffic that misses the original state table is a drop, not a policy miss.

Symptoms operators actually see

  • One-way pcap on each firewall

  • No session on either

  • Two default routes

  • After a new ISP or a new core link

CLI first — copy this block

Run these on the SOC / packet analysis device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

# on FW-A
show session all filter source 10.1.1.10
# on FW-B
show session all filter destination 10.1.1.10
traceroute 203.0.113.10
show route 203.0.113.10
tcpdump -nni any host 10.1.1.10

How to read that output

If A saw SYN and B saw SYN-ACK, routing is asymmetric. More allow rules will not create state.

Triage order

  1. Capture both directions

  2. Align the return path with the forward path

  3. Or put both firewalls in an HA pair / cluster

  4. Remove the extra default route

  5. Retest one flow

Classic traps

What you see

Real cause

Fix

Any-any on both firewalls

State is still missing

Fix the path

Disable stateful inspection

You will regret it

Fix routing

Blame NAT

The SYN-ACK is on the wrong box

Draw the return

Proof the ticket is closed

  • Same firewall sees both directions

  • Session forms

  • App completes

Say this in an interview

I always ask where the SYN-ACK arrived. Two firewalls in one flow is asymmetry until proven shared-state.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page