
728 Appendix D Stateful Packet Filters
N0060606N0060606
Example 3: UDP and SIP
Setup:
Default rule: Enabled – Block all excluding IP phones
Outbound rules: None
Inbound rules: None
Assumptions: No stateful sessions present to start
Scenario:
Inbound PT: UDP, SA: 10.10.10.3, SP: 2001, DA:
10.10.10.1, DP: 2000
No stateful session with [UDP, 10.10.10.1,
10.10.10.3, 2000, 2001] is found. An inbound user
rule is found and stateful is enabled. A new stateful
session is created with a disposition to “pass” only
(but not to mark].
Outbound PT: UDP, SA: 10.10.10.1, SP: 2000, DA:
10.10.10.3, DP: 2001
Stateful session with tuple [UDP, 10.10.10.1,
10.10.10.3, 2000, 2001] is found and the rule is
“pass” only. Hence the packet is not DSC marked.
Inbound PT: UDP, SA: 10.10.10.4, SP: 3001, DA:
10.10.10.1, DP: 3000
No stateful session with [UDP, 10.10.10.1,
10.10.10.4, 3000, 3001] is found. An inbound user
rule is found and stateful is not enabled. No stateful
session is created. The packed is accepted.
Outbound PT: UDP, SA: 10.10.10.1, SP: 3000, DA:
10.10.10.4, DP: 3001
No stateful session [UDP, 10.10.10.1, 10.10.10.4,
3000, 3001] is found. An outbound user rule is
found and stateful is enabled. A new stateful
session is created with a disposition to “pass” and
“mark” with DSCP value 0xC0.
Table 183 Example 3: UDP and SIP (Sheet 1 of 2)
Direction IP Datagram Outcome
Outbound PT: UDP, SA: 10.10.10.1, SP: 5060, DA:
10.10.10.2, DP: 5060
No stateful session [UDP, 10.10.10.1, 10.10.10.2,
5060, 5060] is found. No user outbound user rule is
found and the default rule is used. A new stateful
session is created with a disposition to “pass”.
Inbound PT: UDP, SA: 10.10.10.2, SP: 5060, DA:
10.10.10.1, DP: 5060
Stateful session with tuple [ICMP, 10.10.10.1,
10.10.10.2, 5060, 5060] is found and the rule is
“pass”
<wait 5 mins> SIP calls can be made because they were initiated
in the outbound direction. However, after 5 minutes
of inactivity on the stateful session, it gets deleted.
Inbound PT: UDP, SA: 10.10.10.2, SP: 5060, DA:
10.10.10.1, DP: 5060
No stateful session with [UDP, 10.10.10.1,
10.10.10.3, 2000, 2001] is found. No user inbound
rule is matched, hence the default inbound rule is
used with disposition to “block”. No stateful session
is created and no SIP call can take place.
Table 182 Example 2: UDP with DSCP Marking
Komentarze do niniejszej Instrukcji