- Background
- Static Versus Dynamic Filtering
- Router Mode Versus End-System Mode Firewalls
- Router-Controlled Failover Using Mirrored Router-Mode Firewalls
- Wrap-up
Static Versus Dynamic Filtering
In a static filter, each packet is independently evaluated, with no reference to any preceding packets that may have passed in either direction. A static filter may also be referred to as a static NAT or passive screening firewall. The techniques described here can provide full transparent redundancy and load sharing through firewalls that use static filtering.
In a dynamic filter, the decision on whether to pass a packet depends on what packets have already been through the firewall. Examples of dynamic filters include stateful inspection and proxies. These filters monitor the exchange of packets, effectively opening holes in the firewall for each communications session on an as-needed basis (such as when an inside user places a request for service), and then close the holes as soon as they're no longer needed for authorized traffic.
Transparent proxies depend heavily on dynamic filtering so that protocols such as FTP can work through the firewall without diminishing overall security. The challenge with dynamic firewalls is that the correct behavior of the firewall depends on the state of the firewall, and transparent redundancy is not possible unless the firewall can share that state information with its backup unit. This limits the ability to provide transparent redundancy for dynamic filtering firewalls to those that include proprietary synchronization mechanisms. If there is no synchronization of the dynamic filters, you can automate the failover to a backup firewall, but all open communications sessions requiring state information for continuity will be dropped and need to be reestablished through the replacement firewall before continuing.
When using dynamic filtering firewalls, you must ensure that your routing schemes always route packets between any communicating pair of users crossing a firewall boundary through the same firewall in both directions. Otherwise, the filter opened based on the inside connection request might not be on the firewall used to return the response from the outside system. To minimize service disruptions, this firewall selection must be maintained despite failures in supporting routers or connected networks.