H3C Technologies H3C SecPath F1000-E - Manual (Page 565)

1
Session Management
Session Management Overview
The session management feature is designed to manage sessions of applications such as network
address translation (NAT), application specific packet filter (ASPF), and intrusion protection. This feature
regards packet exchanges at the transport layer as sessions and updates the status of sessions or ages
out sessions according to the information in packets.
Session management allows multiple features to process the same service packet respectively. It
implements the following functions:
• Fast match between packets and sessions
• Management of transport layer protocol state
• Identification of application layer protocol types
• Session aging based on protocol state or application layer protocol type
• Permanent session
• Special packet match for the application layer protocols requiring port negotiation
• Resolution of ICMP error control packets and session match based on resolution results
Session Management Principle
The session management function tracks the status of connections by inspecting the transport layer
protocol (TCP or UDP) information, and performs unified status maintenance and management for all
connections.
In actual applications, session management works together with ASPF to dynamically determine
whether a packet can pass the firewall and enter the internal network according to connection status,
thus preventing intrusion.
Note that the session management function implements only connection status tracking. It cannot block
potential attack packets.
Session Management Implementation
Currently, the session management feature implemented on the device provides the following functions:
• Supporting session creation, session status update and session timeout setting based on protocol
state for IPv4 TCP, UDP, ICMP, and Raw IP sessions.
• Supporting port mapping for application layer protocols and allowing application layer protocols
to use customized ports and session timeout intervals.