A company's web server sits behind a stateful firewall. Clients report that they can send requests to the server, but responses never arrive, even though a packet capture on the server shows the responses being sent out. Network diagrams reveal that outbound traffic from the server is routed through a different firewall than the one through which inbound requests arrive. What is the most likely cause of the failure?
- AAn MTU mismatch is causing the response packets to be fragmented and dropped
- BThe DNS server is returning stale records for the web server
- CAsymmetric routing is causing the stateful firewall to drop return traffic that doesn't match its connection state table
- DThe web server's default gateway is misconfigured with an incorrect subnet mask
Show answer & explanationAnswer & explanation
Correct answer: C. Asymmetric routing is causing the stateful firewall to drop return traffic that doesn't match its connection state table
Stateful firewalls track connection state and expect both directions of a session to traverse the same device. When inbound and outbound traffic take different paths through different firewalls, the firewall handling the return traffic has no matching state entry and drops the packets, even though the server successfully sent them — a classic asymmetric routing problem.
Why the other options are wrong
- A. MTU mismatch would cause fragmentation issues consistently, not path-dependent one-way drops.
- B. Stale DNS would prevent the client from reaching the server at all, not affect only the return path.
- D. A gateway/subnet mask issue would cause complete unreachability, not selective one-way failure.
Asymmetric Routing (Stateful Firewall Impact)
Occurs when inbound and outbound traffic for a session take different network paths; stateful firewalls or NAT devices along only one path may drop return traffic due to missing session state.
- Stateful firewalls require both directions of a flow to pass through the same device.
- Common in networks with multiple internet links/firewalls and asymmetric routing tables.
- Symptoms: server sends replies, but client never receives them.
Memory trick: 'What goes out one door must come back through the same door.'