Technical Tip: How the FortiGate behaves when asymmetric routing is enabled
Description This article describes what happens to TCP, UDP, and ICMP packets when they arrive as asymmetric flows on a FortiGate.It may be seen that hosts on some networks cannot reach certain other networks. This can occur when request and response packets follow different paths and do not cross the same firewall. This behavior is known as asymmetric routing. If a FortiGate receives the response packets, but not the requests, by default, it blocks the packets as invalid.If, for some specific reason, it is required that the FortiGate unit permit asymmetric routing, it can be configured by using the following CLI commands per VDOM:config vdom
   edit <vdom_name>
    config system settings
      set asymroute enable
    end
end Scope FortiGate.Solution When asymmetric routing is enabled, the firewall will behave as follows.For TCP packets:If the packet is a SYN, the FortiGate creates the session, checks the firewall policies, and applies the configuration of the mat
