Enterprise Storage Forum content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Stateful inspection firewalls deliver a higher level of network security by tracking state and context information. The firewalls inspect traffic at multiple layers in the network stack based on state, port, and protocol.
When shopping around for a stateful inspection firewall, it’s important to understand how they work, consider their pros and cons, and review their use cases to see how they can best fit your business’s needs.
Why are Stateful Inspection Firewalls Important?
A stateful firewall is important for the capability of traffic blocking and protection against most types of cybersecurity attacks. Stateful inspection firewalls analyze each packet of data to determine whether the packet should be allowed into the network, and they protect system resources by stopping nonessential traffic. In short, stateful packet inspection, also known as dynamic packet filtering, tracks established connections to ensure effective and complete protection.
The term “Stateful Inspection” was coined by Check Point Software Technologies in 1993, which became the foundation of the company. The early firewalls were “stateful,” meaning they helped to keep track of connections between computers and could retain data packets until enough information was available to decide their state.
A stateful inspection technique was developed to address the limitations of the stateless inspection, and Check Point’s product Firewall-1 was the world’s first commercially available stateful inspection firewall. The necessity for application awareness arose in the early 2000s. To meet this demand, many cybersecurity vendors added application visibility and additional features to stateful inspection firewalls.
Some critical features offered by stateful inspection firewall vendors may include:
- Blocking denial-of-service (DoS) attacks
- Preventing IP spoofing
- Protecting from internal attacks
- Preventing unencrypted communications
Unified threat management (UTM) devices can also combine a firewall with several security capabilities, and UTM’s stateful packet inspection allows incoming and outgoing traffic with web proxy filtering and antivirus services.
Stateful packet inspection firewalls are commonly used in place of stateless inspection, or static packet filtering, but they are well suited to Transmission Control Protocol (TCP) or similar protocols and also support protocols such as User Datagram Protocol (UDP).
Learn more about different types of firewalls and how they are deployed.
How do Stateful Inspection Firewalls Work?
The stateful inspection functionalities are similar to packet filters in that they allow or deny connections based on filtering but also enable monitoring of the communication state. Stateful inspection firewalls track packets from every link passing through it and create a state table of the connections to maintain states by a set of rules. The firewall checks each data packet against the set of rules to determine whether its access should be allowed or denied for the particular session.
The filtering of stateful inspection firewalls is based on state and context information derived from the packet of a session. The state of the connection is reflected in specific flags such as SYN, ACK, and FIN. And the context is the information such as sequence numbers, Internet Protocol (IP) addresses and ports, and several metadata. The firewall stores the state and context information and updates them regularly.
Stateful packet inspection firewalls inspect incoming traffic at multiple layers of the network and operate primarily at the transport and network layers of the Open Systems Interconnection (OSI) model. Filtering decisions depend on the admin’s instructions as well as context, and the firewall can inspect all activity from beginning to end.
The firewalls use deep packet inspection (DPI) to analyze the packet header and also the contents of the packet. To prevent malware, the firewall compares the packet contents to a database of malware signatures, and when there is a match, it blocks the packets from passing through.
Stateful packet inspection firewall working processes can be varied based on the implementation. Generally, the stateful inspection rules work in two basic ways: passive and active.
Passive Stateful Inspection
Passive stateful inspection rules are used by advanced systems that detect suspicious traffic patterns instead of immediately accepting packets that violate standards. The firewalls are more efficient but unable to prevent certain types of attacks such as denial-of-service (DoS) and address spoofing attacks.
Active Stateful Inspection
Active stateful packet inspection rules use similar technologies as passive systems but are more complex and can prevent attacks by taking action if suspicious activity appears. The firewalls enable traffic filtering based on the symptoms of the established connections or network sessions.
Learn more about packet-filtering firewalls.
Pros and Cons of Stateful Inspection Firewalls
Stateful packet inspection firewalls can look deeper into payloads and understand complex protocols that help to deliver instant protection at runtime. Some of the key pros and cons of stateful inspection firewalls are below.
Pros
- Stateful packet inspection firewalls deliver full protocol inspection based on the state and context.
- The firewalls can look deeper into payloads and understand complex protocols.
- Stateful inspection firewalls eliminate the attack surface and enhance the system’s vulnerability management.
- The firewalls inspect incoming traffic at multiple layers of the OSI model.
- Stateful inspection firewalls understand the network flow and can recognize data packets of a flow.
- They are very effective at detecting unauthorized attempts or forged messaging.
- Stateful inspection firewalls can negotiate communication ports and protocols that help to deliver instant protection at runtime.
Cons
- Stateful inspection firewalls are more expensive and do not offer authentication mechanisms.
- Data transfer rates of a stateful inspection firewall are lower than a packet filter.
- There is performance degradation over a packet filter and a lack of fine control.
- Maintaining tables and logic to parse the access lists costs memory and processor power.
- Additional checks require a significant amount of system resources that may reduce speed.
- Stateful inspection firewalls are vulnerable to distributed denial-of-service (DDoS) attacks.
- Man-in-the-middle (MitM) attacks can create even more vulnerabilities in the firewalls.
3 Examples of Stateful Inspection Firewalls
Many reputed cybersecurity vendors offer stateful packet inspection firewalls with context-aware network security features or integrated with other services. Many next-generation firewalls (NGFWs) offer natively integrated stateful firewall capabilities.
Palo Alto Networks
Palo Alto Networks firewall is a stateful firewall, meaning all traffic entering and leaving through the firewall is matched against a session based on a security policy. The traffic matching is an application override policy that identifies sessions that do not process by the App-ID engine and forces the firewall to handle the session as a regular stateful inspection firewall.
The Stream Control Transmission Protocol (SCTP) security feature allows filtering SCTP traffic based on payload protocol IDs (PIDs) by enabling stateful inspection with multi-homing support, multi-chunk inspection, and protocol validation. Users can now enable GTP and SCTP stateful inspection in the firewall gracefully with minimal disruption to GTP and SCTP traffic.
Check Point
Check Point stateful firewall is integrated into the networking stack of the operating system (OS) kernel and sits at the lowest software layer. The firewall ensures full visibility into all traffic incoming and outgoing the system.
The Check Point stateful inspection implementation provides several valuable benefits and the firewall supports hundreds of predefined applications, services, and protocols. The simple and effective design achieves optimum performance and reduces processing overhead.
Moreover, Check Point stateful inspection eliminates the need for context switching and ensures optimal utilization of modern network interfaces, CPU (central processing unit), and OS designs. Check Point’s NGFWs integrate the features of the stateful firewall.
Juniper Networks
The Juniper Networks SRX Series is enabled by the Junos operating system (OS), which is equipped with a robust set of services including the stateful firewall. Juniper Networks MX Series platforms offer powerful routing, switching, security, and service features.
The MS-MPC, MS-MIC, and MX-SPC3 provide dedicated processing for compute-intensive and security services including stateful firewall and deep packet inspection. Routers use firewalls to track and control the flow of traffic and Junos Network Secure stateful firewall provides an extra layer of security. The stateful firewall configuration is supported on the ACX500 indoor routers.
Bottom Line: Completely Protecting Your Business Data
Stateful inspection firewalls are considered more secure than packet filtering firewalls and can take a deep look into the transaction to understand ongoing events. The firewalls can deliver more granular control over how traffic is filtered, and they have extensive logging capabilities that allow for troubleshooting and monitoring. Stateful packet inspection firewalls are today’s choice for core inspection technology.
To ensure complete protection of your business data against today’s threats the right firewall selection is a crucial step. Many cybersecurity vendors are offering stateful inspection firewalls by combining many security services or integrating them with other services. To deploy a stateful inspection firewall, you should focus on some key factors, such as what type of platform or features are needed as well as manageability, budget, and performance requirements.
Read more: 5 Top Storage Security Predictions for 2023
