ZyXEL Communications P-324 User's Guide download pdf (Page 206)

P-2602HWNLI User’s Guide

206 Chapter 13 Firewalls

Figure 108 Stateful Inspection

The previous figure shows the ZyXEL Device’s default firewall rules in action as well as

demonstrates how stateful inspection works. User A can initiate a Telnet session from within

the LAN and responses to this request are allowed. However other Telnet traffic initiated from

the WAN is blocked.

13.5.1 Stateful Inspection Process

In this example, the following sequence of events occurs when a TCP packet leaves the LAN

network through the firewall's WAN interface. The TCP packet is the first in a session, and the

packet's application layer protocol is configured for a firewall rule inspection:

1 The packet travels from the firewall's LAN to the WAN.

2 The packet is evaluated against the interface's existing outbound access list, and the

packet is permitted (a denied packet would simply be dropped at this point).

3 The packet is inspected by a firewall rule to determine and record information about the

state of the packet's connection. This information is recorded in a new state table entry

created for the new connection. If there is not a firewall rule for this packet and it is not an

attack, then the settings in the Firewall General screen determine the action for this

packet.

4 Based on the obtained state information, a firewall rule creates a temporary access list

entry that is inserted at the beginning of the WAN interface's inbound extended access

list. This temporary access list entry is designed to permit inbound packets of the same

connection as the outbound packet just inspected.

5 The outbound packet is forwarded out through the interface.

6 Later, an inbound packet reaches the interface. This packet is part of the connection

previously established with the outbound packet. The inbound packet is evaluated against

the inbound access list, and is permitted because of the temporary access list entry

previously created.

1 2 ... 201 202 203 204 205 206 207 208 209 210 211 ... 441 442

No comments

ZyXEL Communications P-324 User's Guide Page 206