Because of asymmetric routing, some packets come to the firewall out of order hence they are considered invalid.