题库请教，关于stateful TCP checks

lini1984

大家好，请问下面这个题目为什么选择D，求详细解答，十分感谢。
- h& J& f3 T$ J
Which option is one way to mitigate symmetric routing on an active/active firewall setup for TCP-based
2 o3 k# E3 x' j* nconnections?
2 a8 u- T' i. L; K- F* QA. performing packet captures
B. disabling asr-group commands on interfaces that are likely to receive asymetric traffic
C. replacing them with redundant routers and allowing load balancing
7 f) e1 B, Y$ MD. disabling stateful TCP checks
Correct Answer: D
. Y( q9 N; D% D  V  R3 Q

DT1640759

兄台, 我來回答, 因我在香港, 所以用英文回答你, 希望你明白.
6 H! h9 c( X, D2 m+ O
In Asymmetric routing, a packet traverses from a source to a destination in one path and takes a different path when it returns to the source. This is commonly seen in Layer-3 routed networks.

Issues to Consider with Asymmetric Routing
8 `/ o8 ]! V( Q5 D. _& o
) q/ u" y* y+ N' wAsymmetric routing is not a problem by itself, but will cause problems when Network Address Translation (NAT) or firewalls are used in the routed path. For example, in firewalls, state information is built when the packets flow from a higher security domain to a lower security domain. The firewall will be an exit point from one security domain to the other. If the return path passes through another firewall, the packet will not be allowed to traverse the firewall from the lower to higher security domain because the firewall in the return path will not have any state information. The state information exists in the first firewall.

2 K; D  X3 T6 S1 V, RReference: http://www.cisco.com/web/service ... rchives/200903.html
) ?1 m# w8 k( f0 [8 \& L; j
Specifically for TCP-based connections, disabling stateful TCP checks can help mitigate asymmetric routing. When TCP state checks are disabled, the ASA can allow packets in a TCP connection even if the ASA didn’t see the entire TCP 3-way handshake. This feature is called TCP State Bypass.
5 m2 d/ P" @' i
Reference: https://supportforums.cisco.com/ ... ting-and-mitigation
, X0 \' B1 e; x1 Y) [% Q5 K
Note: The active/active firewall topology uses two firewalls that are both actively providing firewall services.
2 J& R  G, e. [6 \; a

DT1640759

唉... 很多時回答問題, 都要等審核, 唉.

3 _  }0 t# `9 t再答一次吧:
' S* E. ^6 i" ]4 B# @% P
In Asymmetric routing, a packet traverses from a source to a destination in one path and takes a different path when it returns to the source. This is commonly seen in Layer-3 routed networks.
6 c/ k2 s8 n% K, G
, m4 z3 U$ g' ~$ q' F$ L9 d8 NIssues to Consider with Asymmetric Routing

+ K, f2 O, X. |. {Asymmetric routing is not a problem by itself, but will cause problems when Network Address Translation (NAT) or firewalls are used in the routed path. For example, in firewalls, state information is built when the packets flow from a higher security domain to a lower security domain. The firewall will be an exit point from one security domain to the other. If the return path passes through another firewall, the packet will not be allowed to traverse the firewall from the lower to higher security domain because the firewall in the return path will not have any state information. The state information exists in the first firewall.

Specifically for TCP-based connections, disabling stateful TCP checks can help mitigate asymmetric routing. When TCP state checks are disabled, the ASA can allow packets in a TCP connection even if the ASA didn’t see the entire TCP 3-way handshake. This feature is called TCP State Bypass.
7 ?8 l/ U" o  i$ N) E. P
Note: The active/active firewall topology uses two firewalls that are both actively providing firewall services.

lini1984

感谢答复，欢迎大家继续回复，参与讨论喔。