Tcp State Bypass Overview; Allowing Outbound And Inbound Flows Through Separate Fwsms - Cisco 7604 Configuration Manual

Chapter 21 Configuring Advanced Connection Features

TCP State Bypass Overview

This section describes how to use TCP state bypass, and includes the following topics:
•
•
•
•

Allowing Outbound and Inbound Flows through Separate FWSMs

By default, all traffic that goes through the FWSM is inspected using the Adaptive Security Algorithm
and is either allowed through or dropped based on the security policy. The FWSM maximizes the firewall
performance by checking the state of each packet (is this a new connection or an established
connection?) and assigning it to either the session management path (a new connection SYN packet), the
accelerated path (an established connection), or the control plane path (advanced inspection). See the
"Stateful Inspection Overview" section on page 1-8
firewall.
TCP packets that match existing connections in the accelerated path can pass through the FWSM without
rechecking every aspect of the security policy. This feature maximizes performance. However, the
method of establishing the session in the accelerated path using the SYN packet, and the checks that
occur in the accelerated path (such as TCP sequence number), can stand in the way of asymmetrical
routing solutions: both the outbound and inbound flow of a connection must pass through the same
FWSM.
For example, a new connection goes to FWSM 1. The SYN packet goes through the session management
path, and an entry for the connection is added to the accelerated path table. If subsequent packets of this
connection go through FWSM 1, then the packets will match the entry in the accelerated path, and are
passed through. But if subsequent packets go to FWSM 2, where there was not a SYN packet that went
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Allowing Outbound and Inbound Flows through Separate FWSMs, page 21-11
Unsupported Features, page 21-12
Compatibility with NAT, page 21-12
Connection Timeout, page 21-13
Configuring TCP State Bypass
for more detailed information about the stateful
21-11