A stateful firewall filters traffic using both packet details and connection context. Unlike a router ACL, which evaluates every packet independently, it can recognize whether a packet belongs to an established communication flow and permit an appropriate reply. section 11.5.1 section 11.6
Core behavior includes:
- Allowing a host in an internal or Inside zone to initiate communication with an external or Outside host, then allowing the reply traffic. section 11.5.1
- Blocking unsolicited traffic initiated from the Outside zone toward the Inside zone when policy does not permit it. section 11.5.1
- Applying policies between multiple zones, including a demilitarized zone (DMZ) for servers that must accept internet connections. section 11.5.1 section 11.6
- Serving as the foundation of a next-generation firewall, which can add application identification, malware protection, and intrusion prevention. section 11.5.2
Internal web request
A host in the Inside zone connects to a web server on the internet. The firewall records the relationship and permits the server’s reply. If the internet host instead initiates a new connection toward the Inside zone, the firewall blocks it under the zone policy. section 11.5.1
Figure 11.10 Simple firewall rules. Hosts in the Inside zone can initiate communications with hosts in the Outside zone, but hosts in the Outside zone cannot initiate communications with hosts in the Inside zone.
Use the zone diagram to compare permitted Inside-to-Outside session establishment with blocked Outside-to-Inside initiation. section 11.5.1
