Firewalls and Stateful Inspection

Firewall types and capabilities

Type/capability	What it examines	Strength/limitation
Packet filter	Addresses, protocol, ports and flags.	Fast and simple; limited application context.
Stateful firewall	Packet fields plus connection/session state.	Automatically associates valid return traffic with an allowed session.
Proxy/application gateway	Terminates and relays application sessions.	Deep control but adds processing and protocol dependency.
Next-generation firewall	State plus application/user/content and threat intelligence.	Rich policy; accuracy depends on visibility, decryption and signatures.
Web application firewall	HTTP/S application requests and responses.	Protects web applications; does not replace a network firewall.

How stateful inspection works

When the first packet of a permitted flow arrives, the firewall evaluates policy and creates a session entry. Later packets are matched against that state, including direction, protocol state, timeout and translated addresses where applicable.

Route/zone context

Policy and NAT lookup

Session created

Return traffic matched

For TCP, the firewall can follow handshake and flag progression. For UDP and ICMP, it maintains pseudo-state based on tuples and timers because these protocols do not have a TCP-style connection setup.

Policy design and rule order

Define source zone/address/user, destination zone/address, application/service and action.
Place narrow rules before broader rules when the platform uses first-match processing.
Use explicit cleanup/default-deny policy and log meaningful denied traffic.
Separate administration access from transit policy.
Document rule owner, business purpose, ticket, review date and expiry.
Avoid using any-any merely to make an incident disappear.

Least privilege: Permit the minimum required communication, but include supporting dependencies such as DNS, NTP, authentication, certificate validation and monitoring.

NAT, routing and zones

Firewalls often perform both routing and NAT, and the processing order affects which address a policy matches. Some platforms evaluate security policy using original addresses, others expose pre-NAT and post-NAT fields in different stages. Always use the vendor's packet-flow documentation.

Zone assignment is generally based on ingress and egress interfaces after route selection. A wrong or missing route can therefore cause a packet to match an unexpected zone pair and policy.

High availability and session synchronisation

Firewall HA pairs can operate active/passive or active/active depending on platform. Heartbeat links exchange health and configuration state; session synchronisation can preserve established traffic after failover, although some sessions may still reset.

Track data interfaces, gateways and critical paths—not only peer heartbeat.
Ensure switches learn the new MAC/ARP/ND state after failover.
Validate licences, content versions and configuration sync.
Test split-brain prevention and management access during failure.
Measure application recovery, not only HA role change.

Logs and packet captures

Evidence	Question answered
Traffic log	Which rule/action/session matched?
Threat/UTM log	Was content blocked by IPS, anti-malware, URL or DNS security?
System log	Did routing, HA, interface or process state change?
Session browser	Are packets/bytes incrementing in both directions?
Packet capture	Where does the packet enter, transform and leave?

Firewall troubleshooting workflow

Write the exact five-tuple plus user/application and timestamp.
Check ingress interface/zone and route-selected egress zone.
Run policy-match or packet-tracer tools if available.
Inspect NAT rule and translated source/destination.
Find the session and compare client/server packet counters.
Check application identification, TLS decryption and security-profile actions.
Verify return routing and upstream ACLs.
Capture at ingress and egress to locate the last visible packet.
Review resource limits, session table, CPU and interface drops.

Interview focus

Use these points to practise concise, operations-focused answers. Explain the concept first, then give a verification or troubleshooting example.

What makes a firewall stateful? It tracks connection/session context and uses that state to evaluate subsequent packets.
Does a permitted destination TCP port alone guarantee an application works? No. Routing, NAT, return policy, inspection, TLS and server state also matter.
What is a firewall zone? A logical trust or policy grouping associated with interfaces or network contexts.
Why are session counters useful? They show whether traffic is entering and returning through the firewall.
Does a WAF replace a network firewall? No. It specialises in web application traffic and complements network controls.

Quick self-check

1. What makes a firewall stateful?

Answer: It tracks connection/session context and uses that state to evaluate subsequent packets.

2. Does a permitted destination TCP port alone guarantee an application works?

Answer: No. Routing, NAT, return policy, inspection, TLS and server state also matter.

3. What is a firewall zone?

Answer: A logical trust or policy grouping associated with interfaces or network contexts.

4. Why are session counters useful?

Answer: They show whether traffic is entering and returning through the firewall.

5. Does a WAF replace a network firewall?

Answer: No. It specialises in web application traffic and complements network controls.

Frequently asked questions

1. Is NAT a security control?

Answer: It can hide addressing and influence reachability, but access control must be enforced by explicit policy.

2. Why does traffic match the wrong rule?

Answer: Rule order, object expansion, application identification, zones or NAT-stage assumptions may differ from expectations.

3. Can HA guarantee zero packet loss?

Answer: No. Recovery depends on detection, state sync, network relearning and application behaviour.

Standards and further reading

Editorial note: Standards explain protocol behaviour, while commands and defaults can differ by vendor, platform and software release. Verify production changes against current vendor documentation.