Table of Contents
Advertisement
ZyAIR G-2000 Plus User's Guide
14.5
Stateful Inspection
With stateful inspection, fields of the packets are compared to packets that are already known
to be trusted. For example, if you access some outside service, the proxy server remembers
things about your original request, like the port number and source and destination addresses.
This remembering is called saving the state. When the outside system responds to your
request, the firewall compares the received packets with the saved state to determine if they
are allowed in. The ZyAIR uses stateful packet inspection to protect the private LAN from
hackers and vandals on the Internet. By default, the ZyAIR's stateful inspection allows all
communications to the Internet that originate from the LAN, and blocks all traffic to the LAN
that originates from the Internet. In summary, stateful inspection:
• Allows all sessions originating from the LAN (local network) to the WAN (Internet).
• Denies all sessions originating from the WAN to the LAN.
Figure 78 Stateful Inspection
The previous figure shows the ZyAIR's default firewall rules in action as well as demonstrates
how stateful inspection works. User A can initiate a Telnet session from within the LAN and
responses to this request are allowed. However other Telnet traffic initiated from the WAN is
blocked.
14.5.1 Stateful Inspection Process
In this example, the following sequence of events occurs when a TCP packet leaves the LAN
network through the firewall's WAN interface. The TCP packet is the first in a session, and the
packet's application layer protocol is configured for a firewall rule inspection:
1 The packet travels from the firewall's LAN to the WAN.
2 The packet is evaluated against the interface's existing outbound access list, and the
packet is permitted (a denied packet would simply be dropped at this point).
185
Chapter 14 Firewalls
Advertisement
Table of Contents
Troubleshooting
