A one-way connection after a network change
A client sends a TCP connection request through a Security Gateway to an internal application server. A server-side capture shows the SYN arriving and the SYN-ACK leaving, while the expected gateway interface does not show the matching reply. The server’s network recently received a new default route through an independent firewall. The original gateway logs an access allowance, and an engineer proposes disabling stateful checks globally because the client still retransmits. The source is translated on one observation path, so addresses differ across captures. The team has access to the relevant routes and can collect short, filtered captures along the return path without making a broad policy change.
1. Which hypothesis is best supported and what evidence should follow?
Read the worked answer
The changed return route is a focused hypothesis. Trace the SYN-ACK from the server through the actual next hops, map translation and state context, and verify whether it returns through the intended enforcement path. The allowance does not prove bidirectional delivery.
2. What correction and acceptance approach is appropriate?
Read the worked answer
Use the evidence to restore the intended path or supported state-sharing design through an authorized scoped change. Retest the original application in both directions and relevant existing sessions. Broad inspection disablement would weaken protection without establishing the routing or state cause.