Digi TransPort, Руководство пользователя

Страница: 668 / 813

Firewall configuration
Digi TransPort User Guide 668
Stateful inspection
The Digi routing code stack contains a sophisticated scripted Stateful Firewall and Route
Inspection engine. Stateful inspection is a powerful tool that allows the router to keep track of a
TCP/UDP or ICMP session and match packets based on the state of the connection on which they
are being carried. In addition to providing sophisticated Firewall functionality the SF/RI engine
also provides a number of facilities for tracking the health of routes, marking dead routes as
being Out Of Service (OOS) and creating rules for the automatic status checking of routes
previously marked as OOS (for use in multilevel backup/restore scenarios).
The firewall can be used to place interface into an OOS state and also control how the interfaces
return to service. When an interface goes OOS, all routes configured to use that interface will
have their route metric set to 16 (the maximum value), meaning that some other route with a
lower metric will be selected.
When a firewall stateful inspection rule expires, a decision is made as to whether the traffic being
allowed to pass by this rule completed successfully or not. For example, if the stateful rule
monitors SYN and FIN packets in both directions for a TCP socket then that rule will expire
successfully. However, if SYNs are seen to pass in one direction but no SYNs pass in the other
direction, the stateful rule will expire and the router will tag this as a failure.
Conditions tagging a stateful rule as a failure
The following conditions tag a stateful rule as a failure:
• Packets have only passed in one direction.
• 10 packets have passed in one direction with no return packets (for TCP the packets must also
be re-transmits) All of these features depend upon the stateful inspection capabilities of the
Firewall engine which are explained below.
The [inspect] field
The [inspect] field takes the following format:
inspect = [“inspect-state” {“oos” {interface-name¦logical-name} secs {t=secs} {c=count}
{d=count}} {r=“ping”¦“tcp”{,secs{secs}}} {rd=x} {dt=secs}{stat}]
The field can be used on its own or with an optional oos (Out Of Service) parameter.