Cisco ASR 5000 series Product Overview page 925

Personal Stateful Firewall Overview
HTTP Application and State
HTTP is the one of the main protocols used on the Internet today. It uses TCP as its transport protocol, and its session
initialization follows the standard TCP connection method.
Due to the TCP flow, the HTTP allows an easier definition of the overall session's state. It uses a single established
connection from the client to the server and all its requests are outbound and responses are inbound. The state of the
connection matches with the TCP state tracking.
For content verification and validation on the HTTP application session, the Personal Stateful Firewall uses DPI
functionality in the chassis.
File Transfer Protocol and State
FTP is an application to move files between systems across the network. This is a two way connection and uses TCP as
its transport protocol.
Due to TCP flow, FTP allows an easier definition of the overall session's state. As it uses a single established
connection from the client to the server, the state of the connection matches with the TCP state tracking.
Personal Stateful Firewall uses application-port mapping along with FTP application-level content verification and
validation with DPI functionality in the chassis. It also supports Pinhole data structure and Initialization, wherein FTP
ALG parses FTP Port command to identify the initiation and termination end points of future FTP DATA sessions. The
source/destination IP and destination Port of FTP DATA session is stored.
When a new session is to be created for a call, a check is made to see if the source/destination IP and Destination Port of
this new session matches with the values stored. Upon match, a new ACS data session is created.
This lookup in the pinhole list is made before port trigger check and stateful firewall ruledef match. If the look up
returns a valid pinhole then a particular session is allowed. Whenever a new FTP data session is allowed because of a
pinhole match the associated pinhole is deleted. Pinholes are also expired if the associated FTP Control session is
deleted in, or when the subscriber call goes down.
OL-22938-02
Understanding Rules with Stateful Inspection ▀
Cisco ASR 5000 Series Product Overview ▄