Network & Infrastructure / Segmentation, TLS & Secure Connectivity
Stateful firewall asymmetry after a routing change
A redundant edge routes outbound and return packets through different firewall instances. Each path is individually reachable, but connection state is unavailable where later packets arrive.
Environment and inputs: Stateful network boundaries, TLS endpoints and IPsec gateways; use the deployed security policy and implementation manual. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record flow tuples, ingress/egress interfaces, session ownership, NAT mappings and routes in both directions. Compare state synchronization health separately from basic peer heartbeat.
Explain the result
A stateful device evaluates packets in a connection context. A route that is valid independently can still break a session when its counterpart traverses another unsynchronized boundary.
Plan the fix
Align the routing design with supported state sharing and failover behavior, or deliberately preserve flow symmetry. Do not solve the problem with a broad stateless permit that bypasses required inspection.
Check the result and rollback
Test established and new sessions during each edge failure and restoration. Revert if the correction changes NAT identity, bypasses inspection or moves a larger flow set than intended.