Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 4: Understanding Policy Configuration
IP Filter rule basics
122
How traffic is filtered if stateful packet inspection is
enabled
When Sidewinder G2 receives TCP, UDP, and ICMP traffic, it starts by
checking an IP Filter session record database to determine if an active session
record exists for this traffic. A session record indicates that this traffic is in
response to a previous successful match to an allow rule. Session records only
exist if the matching rule had stateful packet inspection enabled. Stateful
packet inspection is only an option for TCP, UDP, and ICMP IP Filter rules.
If an active session record exists, the following occurs:
a Perform address rewriting, if required
b Perform session processing
c Forward packet directly to the correct destination interface without any
additional processing
If no active session record exists, the following occurs:
Sidewinder G2 uses the criteria in Table 19 to check the active IP Filter rules
and find a match. The description for how the packet proceeds through the
Sidewinder G2 comes after the table. The flowchart in Figure 50 illustrates the
complete process.
Table 19: Rule matching criteria with stateful packet inspection enabled
Protocol Criteria
TCP/UDP • source IP address
• destination IP address
• ports
ICMP • packet type (echo, message, timestamp)
• source IP address
• destination IP address
• If a matching allow rule does exist, the following occurs:
a Add a session record to the session record database.
b Perform Network Address Translation (NAT) if required.
c Session processing occurs.
d Forward packet directly to the correct destination interface without any
additional processing by the Sidewinder G2.
• If a matching deny rule exists, the packet is discarded without any further
processing.