361
Configuring session management
The session management feature is a common feature designed to implement session-based services
such as NAT, ASPF, and intrusion protection. This feature regards packet exchanges at transport layer
as sessions and updates the status of sessions or ages out sessions according to the information in the
initiators' or responders' packet information.
Session management allows multiple features to process the same service packet. It implements the
following functions:
•
Fast match between packets and sessions
•
Management of transport layer protocol state
•
Identification of application layer protocol types
•
Session aging based on protocol state or application layer protocol type, and early aging
•
Limit on the number of established sessions
•
Persistent session
•
Checksum verification for transport layer protocol packets
•
Special packet match for the application layer protocols requiring port negotiation
•
Resolution of ICMP error control packets and session match based on resolution results
Session management principle
The session management function tracks the status of connections by inspecting the transport layer
protocol (TCP or UDP) information and performs unified status maintenance and management of all
connections.
In actual applications, session management works together with ASPF to dynamically determine whether
a packet can pass the firewall and enter the internal network according to connection status, thus
preventing intrusion.
The session management function implements only connection status tracking. It cannot block potential
attack packets itself.
Implementation
The session management feature provides the following functions:
•
Supporting session creation, session status update and timeout time setting based on protocol state
for such IPv4 packets as TCP, UDP, ICMP, Raw IP packets.
•
Supporting port mapping for application layer protocols and allowing application layer protocols
to use customized ports and adopt different session timeout time.
•
Supporting early aging of sessions in case that ratio of the current number of established sessions
to the maximum number of sessions exceeds the upper limit, and restoration to the normal session
aging when the ratio equals or is less than the lower limit.
•
Supporting checksum verification for TCP, UDP, and ICMP packets. In case of checksum verification
failure, the system does not match sessions or create sessions. Instead, other services based on
session management process the packets.
