There are times where we have to enable asymmetric routing, in order to bypass RPF issues. But singe asymmetric routing is enabled globally in the VDOM, it exposes the entire policy to spoofing. Is there a way to enable asymmetric routing conditionally, for example at certain policies and not globally?
Asymmetric routing should not exist. RPF is a security check, so bypassing this, will also bypass any session-related checks on the firewall, turning it into a router. So you want the firewall to match sessions (match policy) but at the same time not to check sessions (conditionally), which is a bit contradictory.
You should allocate resources to fix the problem that causes the traffic to flow in an asymmetric way, and disable asymmetric routing, not the other way around.
- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.