ccna book reddit

ccna book reddit.9.1.1.3 Stateful Firewall ReviewA stateful firewall, such as an ASA, keeps track of the state of TCP or UDP network connections that pass through it. The firewall is programmed to determine whether packets for different connection types are legitimate. Only packets that match a known active connection are allowed by the firewall; others will be rejected. All forwarded traffic passing through the ASA is checked using the Adaptive Security Algorithm and it is decided whether it is allowed to pass or dropped. The algorithm is going to consider the state of the connection associated with the packet.If the packet creates a new connection, the ASA will examine the packet against the access list and perform other tasks to determine whether to allow or deny the packet. To perform this check, the first packet of the session passes through the "session management path", which is part of the management plane. Depending on the type of traffic, it may also pass through the "control plane path".The session management path is responsible for the following tasks.Performing access list checks.Performing route lookups.Assigning NAT translations (xlates).Establishing sessions in the "fastpath".Some packets require Layer 7 inspection. For protocols with two or more channels, the Layer 7 inspection engine is required. Of these two channels, one is the data channel (using a well-known port number) and the other is the control channel (a different port number used for each session). When packets require Layer 7 inspection, the packet payload must be inspected and changed, and the packet is delivered to the control plane path. Protocols that require Layer 7 inspection include FTP, H.323, and SNMPo support these protocols, the packet filter listens to the initial session and analyzes the application data to learn about the relevant additional negotiation channels. The packet filter then enforces a policy. If the policy states that the initial session is allowed, then any other channels for that application should also be allowed.9.1 Introducing the ASA 257