Unsupported Features; Compatibility With Nat - Cisco 7604 Configuration Manual

Configuring TCP State Bypass
through the session management path, then there is no entry in the accelerated path for the connection,
and the packets are dropped.
traffic goes through a different FWSM than the inbound traffic:
Figure 21-1
If you have asymmetric routing configured on upstream routers, and traffic alternates between two
FWSMs, then you can configure TCP state bypass for specific traffic. TCP state bypass alters the way
sessions are established in the accelerated path and disables the accelerated path checks. This feature
treats TCP traffic much as it treats a UDP connection: when a non-SYN packet matching the specified
networks enters the FWSM, and there is not an accelerated path entry, then the packet goes through the
session management path to establish the connection in the accelerated path. Once in the accelerated
path, the traffic bypasses the accelerated path checks.

Unsupported Features

The following features are not supported when you use TCP state bypass:
•
•

Compatibility with NAT

Because the translation session is established separately for each FWSM, be sure to configure static NAT
on both FWSMs for TCP state bypass traffic; if you use dynamic NAT, the address chosen for the session
on FWSM 1 will differ from the address chosen for the session on FWSM 2.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
21-12
Figure 21-1
Asymmetric Routing
ISP A
FWSM 1
Outbound Traffic
Return Traffic
Application inspection—Application inspection requires both inbound and outbound traffic to go
through the same FWSM, so application inspection is not supported with TCP state bypass.
AAA authenticated sessions—When a user authenticates with one FWSM, traffic returning via the
other FWSM will be denied because the user did not authenticate with that FWSM.
Chapter 21
shows an asymmetric routing example where the outbound
ISP B
FWSM 2
Inside
network
Configuring Advanced Connection Features
OL-20748-01