Examkin

Question

Difficulty: HardFirewalls and Access Control Lists (ACLs)

A network security administrator is configuring a stateful perimeter firewall and documenting how the device inspects incoming network traffic. When an initial TCP SYN packet initiating a new session arrives at the untrusted external interface destined for an internal server, the firewall executes specific operational phases to process the request. In what chronological order, from first to last, does the stateful firewall process this new incoming connection attempt?

  1. 1The firewall inspects its active connection state table to check if the packet belongs to an already established session.
  2. 2The firewall evaluates the packet header attributes against the configured access control policy rules sequentially from top to bottom.
  3. 3The firewall creates a new dynamic session entry in its state table recording the 5-tuple connection parameters.
  4. 4The firewall performs a routing table lookup and forwards the packet out the destination interface toward the target server.

Answer

The correct sequence of stateful firewall operations is: 1) Inspect the active connection state table for an existing session match, 2) Evaluate the packet against static ACL security rules sequentially from top to bottom upon a state table miss, 3) Create a new session entry in the state table using the 5-tuple details after matching a permit rule, and 4) Perform routing table lookup and forward the packet to the destination interface.
Stateful firewalls operate by maintaining session state across network connections. When an inbound packet arrives, the firewall first checks its active connection state table (Item 1). Because an initial TCP SYN packet represents a new session, it results in a state table lookup miss. Next, the firewall evaluates the packet against the configured security policy / ACL rules sequentially from top to bottom (Item 2). If an explicit permit rule matches the packet, the firewall instantiates a new dynamic session entry in the state table capturing the 5-tuple connection metrics (Item 3). Finally, the firewall determines the outbound interface via a routing lookup and forwards the packet to its destination (Item 4).

Step-by-Step Solution

1
Check State Table
State table cache miss identified for the initial TCP SYN packet.
Stateful firewalls optimize processing by checking active state tables first to bypass full ACL rule evaluation for established connections.
2
Evaluate Access Control Rules
Packet matches an explicit permit rule in the firewall policy.
New connection attempts (SYN flag set) must be explicitly allowed by security policy rules processed top-to-bottom.
3
Update State Table
A new session entry tracking source/destination IP, source/destination port, and protocol is added.
Recording the 5-tuple state allows the firewall to implicitly allow returning SYN-ACK traffic without requiring a separate static return ACL rule.
4
Forward Packet
Packet is routed and egressed via the internal interface.
Once security evaluation and state tracking are completed, the firewall passes the packet along its routing path.

Key Concept

Stateful Inspection Workflow and State Table Dynamics
Estimated Time:2m 0s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic