Dynamic or Stateful Packet Filtering Firewalls

This topic explains how dynamic or stateful inspection packet filtering provides improved network security and performance.

Stateful packet filters, or stateful firewalls, are the most versatile and therefore the most common firewall technologies in use. Stateful filtering provides dynamic packet filtering capabilities to firewalls. Stateful inspection is firewall architecture that works at the network layer. Unlike static packet filtering, which examines a packet based on the information in its header, stateful inspection tracks each connection traversing all interfaces of the firewall and confirms that they are valid. Stateful packet filtering maintains a state table. The state table is part of the internal structure of the firewall and tracks all sessions and inspects all packets passing through the firewall. If packets have the expected properties predicted by the state table, the firewall allows them to pass. The state table changes dynamically according to traffic flow.

Stateful firewalls keep track of the actual communication process by using a state table. Stateful firewalls operate at Layers 3, 4, and 5. From a transport layer perspective, the firewall examines information in the headers of Layer 3 packets and Layer 4 segments. For example, the firewall looks at the TCP header for SYN, RST, ACK, FIN, and other control codes to determine the state of the connection. In this scenario, the session layer is responsible for establishing and tearing down the connection.

When an outside service is accessed, the stateful packet filter firewall "remembers" certain details of the request by saving the state of the request in the state table. Each time a TCP or UDP connection is established for inbound or outbound connections, the firewall logs the information in a stateful session flow table. When the outside system responds to your request, the firewall server compares the received packets with the saved state to allow or deny network access.

OSI Model

OSI Model

4-18 Securing Cisco Network Devices (SND) v2.0

© 2006 Cisco Systems, Inc.

The stateful session flow table contains the source and destination addresses, port numbers, TCP sequencing information, and additional flags for each TCP or UDP connection associated with that particular session. This information creates a connection object used by the firewall to compare all inbound and outbound packets against session flows in the stateful session flow table. The firewall permits data only if an appropriate connection exists to validate the passage of that data.

More advanced stateful firewalls include the ability to parse FTP port commands and update the state table to allow FTP to work transparently through the firewall. TCP sequence number interpretation and DNS query and response matching ensure that the firewall only allows packets to return in response to queries that originate from inside the network. These features reduce the threat of TCP RST flood attacks and DNS cache poisoning.

© 2006 Cisco Systems, Inc. Cisco IOS Firewall Configuration 4-19

Continue reading here: Stateful firewalls do not support user authentication of connections

Was this article helpful?

+3 -2