Are the normalization features in ASA and FWSM compatible?
A. In FWSM, TCP Normalization only applies to traffic that hits the TCP complex. Normal data plane (fast path) traffic is not affected. This differs from the ASA in that all ASA traffic is subjected to the normalizer. On the FWSM, if the normalizer is disabled the module falls back to 2.3 behavior. But, if you disable the control-point tcp-normalizer, this prevents strict TCP checks, such as the detection of out-of-sequence segments and monitoring TCP options, on the TCP packets received on the Control Plane for Layer 7 inspection in the FWSM, and are not performed. Thus, it is advisable not to disable it. FWSM does not allow tuning in default tcp-map parameters.
