- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Conditional asymmetric routing
Hello,
There are times where we have to enable asymmetric routing, in order to bypass RPF issues. But singe asymmetric routing is enabled globally in the VDOM, it exposes the entire policy to spoofing. Is there a way to enable asymmetric routing conditionally, for example at certain policies and not globally?
Thanks
Andreas
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Asymmetric routing should not exist. RPF is a security check, so bypassing this, will also bypass any session-related checks on the firewall, turning it into a router.
So you want the firewall to match sessions (match policy) but at the same time not to check sessions (conditionally), which is a bit contradictory.
You should allocate resources to fix the problem that causes the traffic to flow in an asymmetric way, and disable asymmetric routing, not the other way around.
- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
If you really need to disable RPF, you can disable it per interface:
