Conditional asymmetric routing

[aagrafi1]

Hello,

There are times where we have to enable asymmetric routing, in order to bypass RPF issues. But singe asymmetric routing is enabled globally in the VDOM, it exposes the entire policy to spoofing. Is there a way to enable asymmetric routing conditionally, for example at certain policies and not globally?

Thanks

Andreas

[AlexC-FTNT]

Asymmetric routing should not exist. RPF is a security check, so bypassing this, will also bypass any session-related checks on the firewall, turning it into a router. 
So you want the firewall to match sessions (match policy) but at the same time not to check sessions (conditionally), which is a bit contradictory. 

You should allocate resources to fix the problem that causes the traffic to flow in an asymmetric way, and disable asymmetric routing, not the other way around.

[akristof]

Hello,

If you really need to disable RPF, you can disable it per interface:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-Reverse-Path-Forwarding-RPF...