Amer Networks E5Web GUI - Manual (Page 22)

1.2. cOS Core Architecture
1.2.1. State-based Architecture
The cOS Core architecture is centered around the concept of state-based connections.
Traditional IP routers or switches commonly inspect all packets and then perform forwarding
decisions based on information found in the packet headers. With this approach, packets are
forwarded without any sense of context which eliminates any possibility to detect and analyze
complex protocols and enforce corresponding security policies.
Stateful Inspection
cOS Core employs a technique called stateful inspection which means that it inspects and
forwards traffic on a per-connection basis. cOS Core detects when a new connection is being
established, and keeps a small piece of information or state in its state table for the lifetime of
that connection. By doing this, cOS Core is able to understand the context of the network traffic
which enables it to perform in-depth traffic scanning, apply bandwidth management and a
variety of other functions.
The stateful inspection approach additionally provides high throughput performance with the
added advantage of a design that is highly scalable. The cOS Core subsystem that implements
stateful inspection will sometimes be referred to in documentation as the cOS Core state-engine.
1.2.2. cOS Core Building Blocks
The basic building blocks in cOS Core are interfaces, logical objects and various types of rules (or
rule sets).
Interfaces
Interfaces are the doorways through which network traffic enters or leaves the Clavister Security
Gateway. Without interfaces, a cOS Core system has no means for receiving or sending traffic.
The following types of interface are supported in cOS Core:
• Physical interfaces - These correspond to the actual physical Ethernet interfaces.
• Sub-interfaces - These include VLAN and PPPoE interfaces.
• Tunnel interfaces - Used for receiving and sending traffic through VPN tunnels.
Interface Symmetry
The cOS Core interface design is symmetric, meaning that the interfaces of the device are not
fixed as being on the "insecure outside" or "secure inside" of a network topology. The notion of
what is inside and outside is totally for the administrator to define.
Logical Objects
Logical objects can be seen as predefined building blocks for use by the rule sets. The address
book, for instance, contains named objects representing host and network addresses.
Another example of logical objects are services which represent specific protocol and port
Chapter 1: cOS Core Overview
22