McAfee UTILITIES 4.0 Guía de usuario descargar pdf (Pagina 49)

4 If the packet does not match any configurable rule, it is blocked.

Figure 17: Stateful filtering process

How stateful packet inspection works

Stateful packet inspection combines stateful filtering with access to application-level commands,

which secures protocols such as FTP.

FTP involves two connections:

control

for commands and

data

for the information. When a

client connects to an FTP server, the control channel is established, arriving on FTP destination

port 21, and an entry is made in the state table. If the option for FTP inspection has been set

with the Firewall Options policy, when the firewall encounters a connection opened on port 21,

it knows to perform stateful packet inspection on the packets coming through the FTP control

channel.

With the control channel open, the client communicates with the FTP server. The firewall parses

the PORT command in the packet and creates a second entry in the state table to allow the

data connection.

When the FTP server is in active mode, it opens the data connection; in passive mode, the

client initiates the connection. When the FTP server receives the first data transfer command

(LIST), it opens the data connection toward the client and transfers the data. The data channel

is closed after the transmission is completed.

The combination of the control connection and one or more data connections is called a session,

and FTP dynamic rules are sometimes referred to as session rules. The session remains

established until its control channel entry is deleted from the state table. During the periodic

cleanup of the table, if a session’s control channel has been deleted, all data connections are

subsequently deleted.

Stateful protocol tracking

The following is a summary of the types of connections monitored by the stateful firewall and

how they are handled.

Configuring Firewall Policies

Overview of Firewall policies

49McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0

1 2 ... 44 45 46 47 48 49 50 51 52 53 54 ... 111 112

Sin comentarios

McAfee UTILITIES 4.0 Guía de usuario Pagina 49