Cisco ASA 5506-X Configuration Manual page 266

Configure Connection Settings
hostname(config-cmap)# policy-map pmap
hostname(config-pmap)# class urg-class
hostname(config-pmap-c)# set connection advanced-options tmap
hostname(config-pmap-c)# service-policy pmap global
Bypass TCP State Checks for Asynchronous Routing (TCP State Bypass)
If you have an asynchronous routing environment in your network, where the outbound and inbound flow
for a given connection can go through two different ASA devices, you need to implement TCP State
Bypass on the affected traffic.
However, TCP State Bypass weakens the security of your network, so you should apply bypass on very
specific, limited traffic classes.
The following topics explain the problem and solution in more detail.
•
•
•
The Asynchronous Routing Problem
By default, all traffic that goes through the ASA is inspected using the Adaptive Security Algorithm and
is either allowed through or dropped based on the security policy. The ASA maximizes the firewall
performance by checking the state of each packet (is this a new connection or an established
connection?) and assigning it to either the session management path (a new connection SYN packet), the
fast path (an established connection), or the control plane path (advanced inspection). See the general
operations configuration guide for more detailed information about the stateful firewall.
TCP packets that match existing connections in the fast path can pass through the ASA without
rechecking every aspect of the security policy. This feature maximizes performance. However, the
method of establishing the session in the fast path using the SYN packet, and the checks that occur in
the fast path (such as TCP sequence number), can stand in the way of asymmetrical routing solutions:
both the outbound and inbound flow of a connection must pass through the same ASA.
For example, a new connection goes to ASA 1. The SYN packet goes through the session management
path, and an entry for the connection is added to the fast path table. If subsequent packets of this
connection go through ASA 1, then the packets will match the entry in the fast path, and are passed
through. But if subsequent packets go to ASA 2, where there was not a SYN packet that went through
Cisco ASA Series Firewall CLI Configuration Guide
11-10
The Asynchronous Routing Problem, page 11-10
Guidelines for TCP State Bypass, page 11-11
Configure TCP State Bypass, page 11-12
Chapter 11 Connection Settings