Third Gen(Next Gen) Application Layer Understands Service Context Protects Applications.

L grep -v 0 Monitor iptables Read ps aux from top to bottom (processes) Firewalls are not the last resort 0.

Most of the workflow in policy decision is similar to stateless firewall except the mechanism to identify a new workflow and add an automated dynamic stateless ACL entry.

They have gone through massive product feature additions and enhancements over the years.

One particular feature that dates back to 1994 is the stateful inspection.

Lets explore what state and context means for a network connection.

In TCP, the four bits (SYN, ACK, RST, FIN) out of the nine assignable control bits are used to control the state of the connection.

Firewalls can apply policy based on that connection state; however, you also have to account for any leftover, retransmitted, or delayed packet to pass through it after connection termination.

This flag is used by the firewall to indicate a NEW connection.

Although from TCP perspective the connection is still not fully established until the client sends a reply with ACK.

UDP, for example, is a very commonly used protocol that is stateless in nature.

Applications using this protocol either will maintain the state using application logic, or they can work without it.

Few popular applications using UDP would be DNS, TFTP, SNMP, RIP, DHCP, etc.

For example, when a firewall sees an outgoing packet such as a DNS request, it creates an entry using IP address and port of the source and destination.

It then uses this connection data along with connection timeout data to allow the incoming packet, such as DNS, to reply.

A stateless firewall will instead analyze traffic and data packets without requiring the full context of the connection.

A stateless firewall applies the security policy to an inbound or outbound traffic data (1) by inspecting the protocol headers of the packet.

After inspecting, a stateless firewall compares this information with the policy table (2).

From there, it decides the policy action (4.a 4.b): to ALLOW, DENY, or RESET the packet.

This is effective for static policy lookup devices like routers and switches using features like Access Control Lists (ACLs).

To accurately write a policy, both sides of the connection need to be whitelisted for a bidirectional communication protocol like TCP.

Writing two rules for policing one connection becomes problematic.

This inability for writing policies for all the applications creates a big hole in security.

How do you create a policy using ACL to allow all the reply traffic This tool was not built for finer policy controls and is not of much use to a micro-segmentation framework where policy is very fine-grained and directional in nature.

And this process would trigger every time a single rule got added or deleted.

Consider having that much downtime and impact to your critical business for such mundane day to day tasks.

Stateful Vs Stateless Firewall