Managing Sessions; Overview; Session Management Principle; Session Management Functions - HP 6600 Security Configuration Manual

Managing sessions

Overview

Session management is a common feature designed to implement session-based services such as NAT,
ASPF, and intrusion protection. Session management regards packet exchanges at transport layer as
sessions and updates the session status, or ages sessions out according to information in the initiator or
responder packet.
Session management allows multiple features to process the same service packet. Session management
can be applied for the follow purposes:
Fast match between packets and sessions
•
• Management of transport layer protocol state
Identification of application layer protocol types
•
Session aging based on protocol state or application layer protocol type
•
Persistent sessions
•
Checksum verification for transport layer protocol packets
•
• Special packet match for the application layer protocols requiring port negotiation
Resolution of ICMP error control packets and session match based on resolution results
•

Session management principle

Session management tracks the connection status by inspecting the transport layer protocol (TCP or UDP)
information, performing unified status maintenance and management of all connections.
In actual applications, session management works together with ASPF to dynamically determine whether
a packet can pass the firewall and enter the internal network according to connection status, thus
preventing intrusion.
The session management function only implements connection status tracking. It does not block potential
attack packets.

Session management functions

Session management enables the device to provide the following functions:
Supporting session creation, session status update and timeout time setting based on protocol state
•
for such packets as TCP, UDP, ICMP, Raw IP packets.
• Supporting port mapping for application layer protocols and allowing application layer protocols
to use customized ports and adopt different session timeout time.
Supporting checksum verification for TCP, UDP, and ICMP packets.
•
In case of checksum verification failure, the system will not match sessions or create sessions.
Instead, other services based on session management will process the packets.
453