User`s guide

Defining Filters and Firewalls
Filter persistence
Pipeline User’s Guide Preliminary January 30, 1998 6-37
A persistent filter or firewall is maintained even when its associated connection
becomes inactive. Additionally, the filter or firewall can be applied when an
additional session becomes associated with a connection, as is the case with
additional channels of an MPP connection.
Note:
Firewalls need to use persistence to work correctly, but filters do not need
to use persistence to work as designed.
Filter persistence and Connection profiles
Connection profiles describe different contact sites. Perhaps, for a small office,
one profile would apply to a corporate home office, and another profile would
apply to an Internet service provider. In each case, the Pipeline user would like to
use the Secure Access Firewall capability to prevent unauthorized incursions into
the local network by others.
With dial-on-demand and automatic call timeout, the dynamic firewall
capabilities of Secure Access Firewall would prevent in-progress TCP sessions
(such as Telnet or Rlogin) from proceeding after a call termination and restart
(due to inactivity, for example). Without persistence, a new firewall is
constructed when a call starts up with no knowledge of any TCP sessions in
progress, and consequently would block packets for those sessions when starting
the line back up. This has the effect of rendering the in-progress Telnet (or
Rlogin, etc.) sessions inoperative, possibly destroying work in progress that is
dependent on them.
Filter persistence is a way to tell the Pipeline to keep a firewall around even after
the call is terminated. When a new call is placed to (or is received from) the same
station, the Pipeline remembers the original firewall and uses it as if the call had
never been terminated. Thus, the user can continue working without loss.
Conversely, there may be times when a single Connection profile is used for
several different sites. This might be the case if you use the same Connection
Profile to describe multiple different callers. In this case, you do not want the
filters and firewalls to be persistent, since the Pipeline cannot know if calls are
arriving from the same users.