Scenario 2 - D-Link DFL-1600 User Manual

184
1. A packet arrives on the firewall and initial verifications regarding
source/destination IP addresses and source/destination ports are
performed. If this packet is accepted by the firewall's IP rule set, a
connection will be established between the source and destination,
before passing the packet on to the IDS sub-system. If the packet is a
part of an already existing connection, it is also passed on to the IDS
sub-system. If the packet is denied by the IP rule set, it is dropped.
2. The source and destination information of the packet is compared to
the Intrusion Detection Rules. If a match is found, it is passed on to
the next level of IDS processing - pattern matching. If not, it is
accepted, with possible further actions, as defined by the rule set (for
example address translation, logging, etc).
3. The pattern-matching engine searches the payload of the packet for
pre-defined signatures. If a match is found, the final level of IDS
processing will be carried out – the action. If not, the packet is
accepted, with possible further actions, as defined by the rule set (for
example address translation, logging, etc).
4. Depending on the action defined in the Intrusion Detection Rule, the
packet can be dropped, logged, both, or ignored.
19.2.2

Scenario 2

This is similar to the first scenario, but with one big difference. Traffic will
always be passed on to the IDS regardless of the action chosen by the
firewall's IP rule set. This means that traffic that the firewall drops will
also be analyzed. Figure
IP rule set decides that the traffic is not valid and should be dropped and
the traffic is passed to IDS for further analyzing.
1. A packet arrives on the firewall and initial verifications regarding
source/destination IP addresses and source/destination ports are
performed. The firewall's IP rule set decides that this packet should
be dropped, but before that, traffic is passed on to the IDS
sub-system for further analyzing.
2. The source and destination information of new packet is compared to
the Intrusion Detection Rules. If a match is found, it is passed on to
the next level of IDS processing - pattern matching. If not, the packet
is dropped.
Chapter 19. Intrusion Detection System (IDS)
19.2 shows the events sequence when the firewall's
D-Link Firewalls User's Guide