Which two features can be enabled to support asymmetric routing with redundancy on a Palo Alto networks next-generation firewall (NGFW)? (Choose two.)

To keep sessions alive when packets for the same flow follow different paths, both HA peers must be active so either firewall can process the segment that arrives (Active/Active HA). In addition, the firewall must be configured to accept a packet whose first seen segment is not a TCP SYN (non-SYN first-packet option) because, in asymmetric paths, the initial handshake might have traversed another route. Enabling these two settings allows full asymmetric routing with redundancy.

B. Multiple virtual systems are for tenant separation; they do not influence routing behaviour.
D. “Asymmetric routing profile” is not a PAN-OS feature; no such configuration exists.

1. PAN-OS 10.1 Administrator’s Guide – “Enable Asymmetric Path Handling”, command ‘set deviceconfig setting session tcp-reject-non-syn no’, page 845.

2. PAN-OS 10.1 Administrator’s Guide – “Active/Active HA and Asymmetric Routing”, page 284.

3. Palo Alto Networks Knowledge Base Article “Best Practices for Asymmetric Routing”, ID KB-4563, 2021.