stateful firewall

[knaik99]

as per my understanding ---stateful firewall means the device who keeps track record of flow from source to destination.

and such firewall allow reverse flow i.e. destination to source if it is in its record so please explain in simple about this working of stateful firewall

[Enes Simnica]

@knaik99 U got it right, a stateful firewall keeps a session table of active connections. Once it sees traffic from source to destination, it remembers it, so the return traffic is automatically allowed back in. Which means that anything not part of a known session gets dropped..... 

check this and hope it helpSSS: https://learningnetwork.cisco.com/s/question/0D53i00000Ksup8CAB/stateful-firewall-overview

-Enes

[Joseph W. Doherty]

In addition to what @Enes Simnica has provided, although a "FW" typically tracks flows (principally to identify outside traffic that appears to be in response to a flow initiated on the inside), a traffic filter that doesn't use state information might also be considered a FW.  See https://en.wikipedia.org/wiki/Firewall_(computing) for further description.

Also BTW, even a stateful FW may filter traffic, both in and out, without regard to state information or in conjunction with state information.

Also want to mention, FW apps/products often support deeper packet analysis too.  Some even offer the debatable feature of decrypting encrypted traffic using a man-in-the-middle approach.

So, in answer to your request to simply explain how a FW works, would much depend on a particular FW's capabilities and what rules are being applied.

[knaik99]

if there would be asymmetric routing then does Firewall allow such traffic ?

if no then what is the reason as source and destination are same

[Joseph W. Doherty]

if there would be asymmetric routing then does Firewall allow such traffic ?

if no then what is the reason as source and destination are same

It depends on how asymmetrical the traffic is and FW rules.

If the FW, due to asymmetrical routing doesn't "see" a "reply" packet, at all, or perhaps not on the same external facing interface the "request" packet was transmitted on, it would consider such a packet as not matching a known outbound flow and as being "unsolicited" and could reject it.

If the asymmetrical routing isn't "visible" to the FW, it's not an issue.  For example, when dealing with the Internet, there may be asymmetrical routing within it, "invisible" to your FW.