Status and Policy Entries

Size: px

Start display at page:

Download "Status and Policy Entries"

Geoffrey Byrd
6 years ago
Views:

1 The following article provides a list of all available status types and policies of firewall processes. The status is displayed in the Details dialog of the selected firewall status accessible via the Live view of the Barracuda NG Firewall (see: How to Access Realtime Information [1] ). Status Types The following status types exist: Status Name Origin Description FWD-NEW FWD-FSYN-RCV FWD-RSYN-RSV FWD-EST FWD-RET FWD-FFIN-RCV FWD-RLACK FWD-RFIN-RCV FWD-FLACK FWD-WAIT FWD-TERM IFWD-NEW IFWD-SYN-SND IFWD-EST IFWD-RET IFWD-FFIN-RCV IFWD-RLACK IFWD-RFIN-RCV IFWD-FLACK The initial SYN packet received from the session source was forwarded. The session destination answered the SYN with a SYN/ACK packet. The SYN/ACK packet was acknowledge by the session source. The TCP session is established. Either source or destination are retransmitting packets. The connection might be dysfunctional. The session source sent a FIN datagram indicating to terminate the session. The session destination answered the FIN packet with a FIN reply and awaits the last acknowledgement for this packet. The session destination sent a FIN datagram indicating to terminate the session The session source answered the FIN packet with a FIN reply and awaits the last acknowledgement for this packet. The session was reset by one of the two participants by sending a RST packet. A wait period of 5 seconds will silently discard all packet belonging to that session. A SYN packet was sent to the destination initiating the session (Note that the session with the source is already established). The destination replied the SYN with a SYN/ACK. The session is established. Either source or destination are re transmitting packets. The connection might be disfunctional. The session source sent a FIN datagram indicating to terminate the session. The session destination answered the FIN packet with a FIN reply and awaits the last acknowledgement for this packet. The session destination sent a FIN datagram indicating to terminate the session. The session source answered the FIN packet with a FIN reply and awaits the last acknowledgement for this packet. 1 / 5

2 IFWD-WAIT IFWD-TERM PXY-NEW PXY-CONN PXY-ACC PXY-EST PXY-SRC-CLO PXY-DST-CLO PXY-SD-CLO PXY-TERM IPXY-NEW IPXY-ACC IPXY-CONN IPXY-EST IPXY-SRC-CLO IPXY-DST-CLO IPXY-SD-CLO IPXY-TERM UDP-NEW UDP-RECV UDP UDP The session was reset by one of the two participants by sending a RST packet. A wait period of 5 seconds will silently discard all packet belonging to that session. A socket connection to the destination is in progress of being established A socket connection to the source is in progress of being accepted. Two established TCP socket connection to the source and destination exist. The socket to the source is closed or is in the closing process. The socket to the destination is closed or is in the closing process. The source and the destination socket are closed or in the closing process. A socket connection to the source is in progress of being accepted. A socket connection to the destination is in progress of being established. Two established TCP socket connection to the source and destination exist. The socket to the source is closed or is in the closing process. The socket to the destination is closed or is in the closing process. The source and the destination socket are closed or in the closing process. UDP-REPL UDP The destination replied to the traffic sent by the source. UDP-SENT UDP-FAIL ECHO-NEW ECHO-RECV UDP UDP ECHO ECHO The source transmitted further traffic after having received a reply from ECHO-REPL ECHO The destination replied to the traffic sent by the source. 2 / 5

3 ECHO-SENT ECHO-FAIL OTHER-NEW OTHER-RECV OTHER-REPL OTHER-SENT OTHER-FAIL 3 / 5 ECHO ECHO The source sent more traffic after racing a reply from the destination. The destination replied to the traffic sent by the source. The source sent more traffic after receiving a reply from the destination. LOC-NEW A local TCP session was granted by the local ruleset. LOC-EST The local TCP session is fully established. LOC-SYN-SND A Local-Out TCP session is initiated by sending a SYN packet. LOC-SYN-RCV A Local-In TCP session is initiated by receiving a SYN packet. LOC-FIN-WAIT1 LOC-FIN-WAIT2 LOC-TIME-WAIT An established local TCP session started the close process by sending a FIN packet. A local TCP session in the FIN-WAIT1 state received an ACK for the FIN packet. A local TCP session in the FIN-WAIT1 or in the FIN-WAIT2 state received a FIN packet. LOC-CLOSE An established local TCP session is closed. LOC-CLOSE-WAIT LOC-LAST-ACK An established local TCP session received a FIN packet. Application holding an established TCP socket responded to a received FIN by closing the socket. A FIN is sent in return. LOC-LISTEN A local socket awaits connection request (SYN packets). LOC-CLOSING A local socket in the FIN_WAIT1 state received a FIN packet. LOC-FINISH A local TCP socket was removed from the internal socket list. Policy Entries The following entries are possible: Entry NO_MATCH_IIF NO_MATCH_OIF INBOUND FWD_FILTER REV_FILTER TRACE NOTIFY_CONECT Description Received packet (Forward Direction) must NOT match initial input interface. Received packet (Reverse Direction) must NOT match initial output interface. Session is set to accept policy. Content filter is applied for forward traffic. Content filter is applied for reverse traffic. Session is being traced. Session will notify the Firewall Service upon successful or failing TCP establishment. Needed for multiple redirection status. Source-Based NAT Bind IP is determined by the routing table. NOLOG NOSTAT NOCACHE Session will not generate log file entries. Session will not generate statistics. Session will not generate an access cache entry.

4 NONAGLE LOG_STATE OWN_LOG SRVSTAT DYNAMIC_PORT NOSYNC CLEAR_ECN Nagle algorithm is turned OFF. Session will log each state change / Every state change of this session is logged. Session will log to firewall rule log file. Session will resolve service object names when generating statistics. Session is dynamically NATed. The outgoing source port will differ from the original client port. Session will not be synchronized for transparent failover. Session will clear any ECN bits in the IP header. 4 / 5

5 Links 5 / 5

Monitoring Active and Recent Connections

Monitoring Active and Recent Connections To monitor network sessions or connections, view the following pages from the BASIC tab: Active Connections Lists all of the open and established sessions on the appliance. Recent Connections Lists all