Cisco 7604 Configuration Guide - Page 44

Stateful Inspection Overview Chapter 1 Introduction to the Firewall Services Module Stateful Inspection Overview All traffic that goes through the firewall is inspected using the Adaptive Security Algorithm and is either allowed through or dropped. A simple packet filter can check for the correct source address, destination address, and ports, but it does not check that the packet sequence or flags are correct. A filter also checks every packet against the filter, which can be a slow process. Note The following feature allows you to customize the packet flow: "Configuring TCP State Bypass" section on page 21-10. A stateful firewall like the FWSM, however, takes into consideration the state of a packet: • Is this a new connection? If it is a new connection, the firewall has to check the packet against access lists and perform other tasks to determine if the packet is allowed or denied. To perform this check, the first packet of the session goes through the "session management path," and depending on the type of traffic, it might also pass through the "control plane path." Note The first packet for a session cannot be comprised of fragments for a packet that is larger than 8500 Bytes. The session will be established, but only the first 8500 Bytes will be sent out. Subsequent packets for this session are not affected by this limitation. The session management path is responsible for the following tasks: - Performing the access list checks - Performing route lookups - Allocating NAT translations (xlates) - Establishing sessions in the "accelerated path" Some packets that require Layer 7 inspection (the packet payload must be inspected or altered) are passed on to the control plane path. Layer 7 inspection engines are required for protocols that have two or more channels: a data channel, which uses well-known port numbers, and a control channel, which uses different port numbers for each session. These protocols include FTP, H.323, and SNMP. Note The FWSM performs session management path and accelerated path processing on three specialized networking processors. The control plane path processing is performed in a general-purpose processor that also handles traffic directed to the FWSM and configuration and management tasks. • Is this an established connection? If the connection is already established, the firewall does not need to recheck packets; most matching packets can go through the accelerated path in both directions. The accelerated path is responsible for the following tasks: - IP checksum verification - Session lookup - TCP sequence number check - NAT translations based on existing sessions Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 1-8 OL-20748-01