Cisco ASA Series Cli Configuration Manual page 1338

Licensing Requirements for Connection Settings
Inspection Overview" section on page 1-30
TCP packets that match existing connections in the fast path can pass through the ASA without
rechecking every aspect of the security policy. This feature maximizes performance. However, the
method of establishing the session in the fast path using the SYN packet, and the checks that occur in
the fast path (such as TCP sequence number), can stand in the way of asymmetrical routing solutions:
both the outbound and inbound flow of a connection must pass through the same ASA.
For example, a new connection goes to ASA 1. The SYN packet goes through the session management
path, and an entry for the connection is added to the fast path table. If subsequent packets of this
connection go through ASA 1, then the packets will match the entry in the fast path, and are passed
through. But if subsequent packets go to ASA 2, where there was not a SYN packet that went through
the session management path, then there is no entry in the fast path for the connection, and the packets
are dropped.
a different ASA than the inbound traffic:
Figure 1-1
If you have asymmetric routing configured on upstream routers, and traffic alternates between two
ASAs, then you can configure TCP state bypass for specific traffic. TCP state bypass alters the way
sessions are established in the fast path and disables the fast path checks. This feature treats TCP traffic
much as it treats a UDP connection: when a non-SYN packet matching the specified networks enters the
ASA, and there is not an fast path entry, then the packet goes through the session management path to
establish the connection in the fast path. Once in the fast path, the traffic bypasses the fast path checks.
Licensing Requirements for Connection Settings
Model License Requirement
All models Base License.
Cisco ASA Series CLI Configuration Guide
1-4
Figure 1-1 shows an asymmetric routing example where the outbound traffic goes through
Asymmetric Routing
ISP A
Security
appliance 1
Outbound?Traffic
Return?Traffic
network
for more detailed information about the stateful firewall.
ISP B
Security
appliance 2
Inside
Chapter 1 Configuring Connection Settings