Application-Level Traffic And States - Cisco ASR 5000 series Product Overview

▀ Understanding Rules with Stateful Inspection
State Flag Description
TIME-WAIT The state of the initiating host that received the final FIN and has sent an ACK to close the connection and
waiting for an acknowledgement of ACK from the connection peer. Note that the amount of time the TIME-
STATE is defined to pause is equal to the twice of the Maximum Segment Lifetime (MSL), as defined for the
TCP implementation.
CLOSING A state that is employed when a connection uses the unexpected simultaneous close.
UDP Protocol and Connection State
UDP is a connection-less transport protocol. Due to its connection-less nature, tracking of its state is a more complicated
process than TCP. The Personal Stateful Firewall tracks a UDP connection in a different manner than TCP. A UDP
packet has no sequence number or flag field in it. The port numbers used in UDP packet flow change randomly for any
given session connection. So the Personal Stateful Firewall keeps the status of IP addresses.
UDP traffic cannot correct communication issues on its own and it relies entirely on ICMP as its error handler. This
method makes ICMP an important part of a UDP session for tracking its overall state.
UDP has no set method of connection teardown that announces the session's end. Because of the lack of a defined
ending, the Personal Stateful Firewall clears a UDP session's state table entries after a preconfigured timeout value
reached.
ICMP Protocol and Connection State
ICMP is also a connection-less network protocol. The ICMP protocol is often used to return error messages when a host
or protocol cannot do so on its own. ICMP response-type messages are precipitated by requests using other protocols
like TCP or UDP. This way of messaging and its connection-less and one-way communication make the tracking of its
state a much more complicated process than UDP. The Personal Stateful Firewall tracks an ICMP connection based on
IP address and request message type information in a state table.
Like UDP, the ICMP connection lacks a defined session ending process, the Personal Stateful Firewall clears a state
table entry on a predetermined timeout.

Application-Level Traffic and States

The Personal Stateful Firewall uses Deep Packet Inspection (DPI) functionality to manage application-level traffic and
its state. With the help of DPI functionality, the Personal Stateful Firewall inspects packets up to Layer-7. It takes
application behaviors into account to verify that all session-related traffic is properly handled and then decides which
traffic to allow into the network.
Different applications follow different rules for communication exchange so the Personal Stateful Firewall manages the
different communication sessions with different rules through DPI functionality.
The Personal Stateful Firewall also provides inspection and filtering functionality on application content with DPI.
Personal Stateful Firewall is responsible for performing many simultaneous functions and it detect, allow, or drop
packets at the ingress point of the network.
▄ Cisco ASR 5000 Series Product Overview
Personal Stateful Firewall Overview
OL-22938-02