CloudLabBox
Try the free demo

Firewalls and VPNs lab 15 of 16

Asymmetric routing and stateful firewalls

A routing change sends replies back through a different firewall from the one the request used. Find the three places the traffic dies (an IOS strict uRPF check, the FortiGate session table and the ASA's TCP state check) with each vendor's own tools, then fix the routing rather than switching the safety checks off.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 15 - Asymmetric routing and stateful firewalls

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
6 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Pennard Hosting's web server (SRV, 10.10.0.10) sits behind two firewalls. Customers reach it through the ASA; the FortiGate is only meant for the servers' own outbound updates. Last night someone pointed CORE's default route at the FortiGate "to spread the load". This morning customers can't reach the web server. Find out where the traffic dies, on each device, before you fix it.

DeviceInterfaceAddressNotes
EDGEGi0/0 / Gi0/1 / Gi0/2192.0.2.254 / 198.51.100.254 / 203.0.113.1 (/24)Sends 10.10.0.0/24 to the ASA
CUST-FW (ASA)inside / outside10.0.1.1/24 / 192.0.2.1/24ACL OUTSIDE-IN allows web and ping to SRV
FGTport2 / port110.0.2.1/24 / 198.51.100.1/24Policy 1 lets the servers out (no NAT)
COREGi0/0 / Gi0/1 / Gi0/210.10.0.1 / 10.0.1.2 / 10.0.2.2 (/24)Strict uRPF on Gi0/1; default route to the FortiGate
SRVGi0/010.10.0.10/24Web server
REMOTEGi0/0203.0.113.10/24A customer; also runs a web server

What you’ll practise

  • Explain why stateful firewalls and strict uRPF drop asymmetric traffic
  • Read IOS uRPF counters and compare strict and loose mode
  • Read the FortiGate packet flow with diagnose debug flow and recognise a missing session
  • Read the ASA connection table and accelerated-security-path drop counters
  • Restore symmetric routing and know the risky escape hatches (TCP state bypass, asymroute)

The tasks

  1. Reproduce the fault and draw both paths
  2. The first drop: strict uRPF on CORE
  3. The second drop: no session on the FortiGate
  4. The third drop: the ASA's TCP state check
  5. Fix the design, not the checks

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Asymmetric routing and stateful firewalls6 nodes, 6 links. Every link is listed as text below the diagram.EDGECUST-FWFGTCORESRVREMOTEGi0/0Gi0/0Gi0/0Gi0/1port2Gi0/2Gi0/0Gi0/1Gi0/1port1Gi0/2Gi0/0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • EDGE Gi0/0 to CUST-FW Gi0/1
  • EDGE Gi0/1 to FGT port1
  • EDGE Gi0/2 to REMOTE Gi0/0
  • CUST-FW Gi0/0 to CORE Gi0/1
  • FGT port2 to CORE Gi0/2
  • CORE Gi0/0 to SRV Gi0/0
Nodes in Asymmetric routing and stateful firewalls, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
EDGECisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
CUST-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
FGTFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
CORECisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SRVCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
REMOTECisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 15 - Asymmetric routing and stateful firewalls and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.