Assymetric Routing / Statefull Inspection Firewall

Wed Mar 17 07:51:24 UTC 2004

On Tue, 16 Mar 2004 alex at pilosoft.com wrote:

> If you are asking for stateful filtering for a firewall that sees only
> one-way conversation, it does not exist and cannot exist, by definition.

On a purely theoretical level, I'll disagree.

A stateful inspection firewall needs to know about the packets going in
one direction to do something intelligent with the packets going in one
direction.  That does not mean the firewall needs to see all the packets,
just that it needs to know about them.

Systems for communicating information about flows and state between
firewalls exist.  Cisco does this on the PIXes for redundant firewalls, so
that a fail-over can happen without connections being dropped.  I assume
other firewall manufacturers do that in this context as well.

What would be needed in this case would be to have the firewalls at the
various different network entry points share information about connection
state with eachother.  This sounds pretty easy, but whether the
information sharing would happen fast enough to process return traffic on
a new connection is a question I don't know the answer to.  I don't know
if anybody is making firewalls that actually do this.

-Steve