Table of Contents
Advertisement
9-10 Firewalls
1. The packet travels from the firewall's LAN to the WAN.
2. The packet is evaluated against the interface's existing outbound access list,
and the packet is permitted (a denied packet would simply be dropped at this
point).
3. The packet is inspected by a firewall rule to determine and record information
about the state of the packet's connection. This information is recorded in a
new state table entry created for the new connection. If there is not a firewall
rule for this packet and it is not an attack, then The default action for packets
not matching following rules field (see Figure 11-3) determines the action for
this packet.
4. Based on the obtained state information, a firewall rule creates a temporary
access list entry that is inserted at the beginning of the WAN interface's
inbound extended access list. This temporary access list entry is designed to
permit inbound packets of the same connection as the outbound packet just
inspected.
5. The outbound packet is forwarded out through the interface.
6. Later, an inbound packet reaches the interface. This packet is part of the
connection previously established with the outbound packet. The inbound
packet is evaluated against the inbound access list, and is permitted because of
the temporary access list entry previously created.
7. The packet is inspected by a firewall rule, and the connection's state table entry
is updated as necessary. Based on the updated state information, the inbound
extended access list temporary entries might be modified, in order to permit
only packets that are valid for the current state of the connection.
8. Any additional inbound or outbound packets that belong to the connection are
inspected to update the state table entry and to modify the temporary inbound
access list entries as required, and are forwarded through the interface.
When the connection terminates or times out, the connection's state table entry
9.
is deleted and the connection's temporary inbound access list entries are
deleted.
317516-A Rev 00
Advertisement
Table of Contents
