6
Firewall
100
Before
the
route
lookup
is
completed,
the
SEG
first
checks
that
traffic
from
the
source
network
should,
in
fact,
be
arriving
on
the
interface
where
it
was
received.
This
is
done
by
the
SEG
performing
a
reverse
route
lookup
,
which
means
that
the
relevant
routing
table
is
searched
for
a
route
that
indicates
the
network
should
be
found
on
that
interface.
This
second
route
should
logically
exist
if
a
flow
is
bi
‐
directional,
and
it
must
have
a
pair
of
routes
associated
with
it,
one
for
each
direction.
IP rule evaluation
When
a
new
flow,
such
as
a
TCP/IP
connection,
is
being
established
through
the
SEG,
the
list
of
IP
rules
are
evaluated
from
top
to
bottom
until
a
rule
that
matches
the
parameters
of
the
new
flow
is
found.
The
first
matching
rule's
Action
is
then
performed.
For
this
reason,
the
ordering
of
the
IP
rules
in
the
rule
set
is
important.
If
the
action
in
the
matching
IP
rule
allows
it,
the
establishment
of
the
new
flow
will
proceed.
A
new
entry
representing
the
new
flow
will
then
be
added
to
the
SEG
internal
list
of
active
flows.
This
list
allows
monitoring
of
opened
and
active
flows.
If
the
matching
IP
rule
action
is
Deny
or
Reject
,
the
flow
is
not
set
up.
Tip:
It
is
important
to
remember
that
the
SEG
searches
the
IP
rules
from
top
to
bottom,
looking
for
the
first
matching
rule.
If
an
IP
rule
seems
to
be
ignored,
check
that
some
other
rule
above
it
isn't
being
triggered
first.
Stateful inspection
After
initial
rule
evaluation
of
the
opening
flow,
subsequent
packets
belonging
to
that
flow
will
not
need
to
be
evaluated
individually
against
the
rule
set.
Instead,
a
highly
efficient
algorithm
searches
the
flow
table
for
each
packet
to
determine
if
it
belongs
to
an
established
flow.
This
approach
is
known
as
stateful
inspection
and
is
applied
not
only
to
stateful
protocols
such
as
TCP
but
also
to
stateless
protocols
such
as
UDP
and
ICMP
by
means
of
“pseudo
‐
connections.”
This
approach
means
that
evaluation
against
the
IP
rule
set
is
done
only
in
the
initial
opening
phase
of
a
flow.
Consequently,
the
size
of
the
IP
rule
set
has
negligible
effect
on
overall
throughput.
Flows
are
unidirectional.
This
means
that
a
typical
traffic
connection,
for
example,
between
a
Web
browsing
client
and
a
Web
server,
will
consist
of
two
flows.
This
is
not
the
case
with
the
ESP
flows
used
in
IPsec
where
only
a
single
flow
is
required
for
the
connection.
Examining flows
All
current
flows
can
be
shown
using
the
flow
CLI
command.
Some
typical
output
is
shown
below:
Device:/>
flow
‐
show
Proto
Source
Destination
Timeout
‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐
TCP
wan:10.6.58.2:2112
core:10.6.58.100:22
262142
