![background image](http://html.mh-extra.com/html/zyxel-communications/vantage-cnm-2-0/vantage-cnm-2-0_user-manual_945619168.webp)
Vantage CNM 2.0 User’s Guide
171
Chapter 12 Configuration > Firewall
are allowed in. The ZyXEL device uses stateful packet inspection to protect the private LAN
from hackers and vandals on the Internet. By default, the ZyXEL device’s stateful inspection
allows all communications to the Internet that originate from the LAN, and blocks all traffic to
the LAN that originates from the Internet. In summary, stateful inspection:
• Allows all sessions originating from the LAN (local network) to the WAN (Internet).
• Denies all sessions originating from the WAN to the LAN.
12.4.1 Stateful Inspection Process
In this example, the following sequence of events occurs when a TCP packet leaves the LAN
network through the firewall's WAN interface. The TCP packet is the first in a session, and the
packet's application layer protocol is configured for a firewall rule inspection:
1
The packet travels from the firewall's LAN to the WAN.
2
The packet is evaluated against the interface's existing outbound access list, and the
packet is permitted (a denied packet would simply be dropped at this point).
3
The packet is inspected by the firewall to determine and record information about the
state of the packet's connection. This information is recorded in a new state table entry
created for the new connection. If there is not a firewall rule for this packet and it is not an
attack, then Firewall Summary screen’s Action for packets that don’t match firewall
rules field determines the action for this packet.
4
Based on the obtained state information, a firewall rule creates a temporary access list
entry that is inserted at the beginning of the WAN interface's inbound extended access
list. This temporary access list entry is designed to permit inbound packets of the same
connection as the outbound packet just inspected.
5
The outbound packet is forwarded out through the interface.
6
Later, an inbound packet reaches the interface. This packet is part of the connection
previously established with the outbound packet. The inbound packet is evaluated against
the inbound access list, and is permitted because of the temporary access list entry
previously created.
7
The packet is inspected by a firewall rule, and the connection's state table entry is updated
as necessary. Based on the updated state information, the inbound extended access list
temporary entries might be modified, in order to permit only packets that are valid for the
current state of the connection.
8
Any additional inbound or outbound packets that belong to the connection are inspected
to update the state table entry and to modify the temporary inbound access list entries as
required, and are forwarded through the interface.
9
When the connection terminates or times out, the connection's state table entry is deleted
and the connection's temporary inbound access list entries are deleted.
Содержание VANTAGE CNM 2.0 -
Страница 30: ...Vantage CNM 2 0 User s Guide 33 Chapter 1 Introducing Vantage ...
Страница 40: ...Vantage CNM 2 0 User s Guide 43 Chapter 2 GUI Introduction ...
Страница 66: ...Vantage CNM 2 0 User s Guide 69 Chapter 4 Configuration Select Device BB General ...
Страница 78: ...Vantage CNM 2 0 User s Guide 81 Chapter 5 Configuration LAN ...
Страница 96: ...Vantage CNM 2 0 User s Guide 99 Chapter 7 Configuration DMZ ...
Страница 126: ...Vantage CNM 2 0 User s Guide 129 Chapter 8 Configuration WAN ...
Страница 140: ...Vantage CNM 2 0 User s Guide 143 Chapter 9 Configuration NAT ...
Страница 144: ...Vantage CNM 2 0 User s Guide 147 Chapter 10 Configuration Static Route ...
Страница 162: ...Vantage CNM 2 0 User s Guide 165 Chapter 11 Configuration VPN ...
Страница 182: ...Vantage CNM 2 0 User s Guide 185 Chapter 12 Configuration Firewall ...
Страница 188: ...Vantage CNM 2 0 User s Guide 191 Chapter 13 Configuration Device Log ...
Страница 236: ...Vantage CNM 2 0 User s Guide 239 Chapter 18 Other System Screens ...
Страница 239: ...Vantage CNM 2 0 User s Guide Chapter 19 Monitor Alarms 242 Figure 132 Monitor Current Alarms ...
Страница 242: ...Vantage CNM 2 0 User s Guide 245 Chapter 19 Monitor Alarms ...
Страница 248: ...Vantage CNM 2 0 User s Guide 251 Chapter 20 Other Monitor Screens ...
Страница 254: ...Vantage CNM 2 0 User s Guide 257 Figure 151 WFTPD Pro Log On ...
Страница 266: ...Vantage CNM 2 0 User s Guide 269 ...
Страница 274: ...Vantage CNM 2 0 User s Guide 277 ...
Страница 286: ...Vantage CNM 2 0 User s Guide 289 ...
Страница 288: ...Vantage CNM 2 0 User s Guide 291 ...
Страница 291: ...Vantage CNM 2 0 User s Guide 294 Figure 181 ESS Provides Campus Wide Coverage ...
Страница 292: ...Vantage CNM 2 0 User s Guide 295 ...
Страница 312: ...Vantage CNM 2 0 User s Guide 315 ...