Statefull Firewall

[henockk]

Dear all   I am new to Firewall Technologies and I want to ask Regardless of statefull Firewall feature. A statefull firewall maintains the tcp state and knows a user session so why do we need to allow a user to allow in both direction incoming and outgoing for same traffic if the state is already known when the user requests the session is known and the firewall knows for the returning also 

[MHM Cisco World]

IN-FW-OUT
TCP initiate from OUT to server in IN 
mandatory you need here ACL in OUT 

TCP initiate from IN to server in OUT

optional to make IN only can access Server in OUT other traffic will deny

[Rob Ingram · Accepted solution]

@henockk with a stateful firewall, permitting inside to outside traffic is sufficient to allow traffic initiated from the inside network to outside. The firewall would permit the return traffic.

By default traffic from outside to inside is usually denied, unless explictly permitted. You'd only permit traffic from outside to inside if the traffic is initiated on the outside. On a perimeter firewall this is used when accessing a website in the DMZ or when bi-directional traffic is required in a WAN scenario.

[Marius Gunnerud]

What are you asking?  Do you mean if a user is already allowed from inside to outside, then if the user moves to the outside network that user should already be allowed access from the outside to inside?

The issue here is where the user traffic is generated from.  When the traffic is generated from the inside network usually there is an access-list statement, or in some cases a security level, that permits the user access to the outside network.  In this case the connection is entered into the state table and return traffic will be allowed.

If that user was to move to the outside network and initiates a connection towards the inside the traffic will be denied by default as the user has now initiated a new connection which there is no access-list for.  So, in short, what gets added to the state table depends on where the traffic is being initiated from and if there are access rules that allow the connection (and possibly NAT statements)