Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
aagrafi1
New Contributor III

Conditional asymmetric routing

Hello,

 

There are times where we have to enable asymmetric routing, in order to bypass RPF issues. But singe asymmetric routing is enabled globally in the VDOM, it exposes the entire policy to spoofing. Is there a way to enable asymmetric routing conditionally, for example at certain policies and not globally?

 

Thanks

Andreas

2 REPLIES 2
AlexC-FTNT
Staff
Staff

Asymmetric routing should not exist. RPF is a security check, so bypassing this, will also bypass any session-related checks on the firewall, turning it into a router. 
So you want the firewall to match sessions (match policy) but at the same time not to check sessions (conditionally), which is a bit contradictory. 

 

You should allocate resources to fix the problem that causes the traffic to flow in an asymmetric way, and disable asymmetric routing, not the other way around.


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
akristof
Staff
Staff

Hello,

If you really need to disable RPF, you can disable it per interface:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-Reverse-Path-Forwarding-RPF...

 

Adrian
Labels
Top Kudoed Authors