Stateful protocol tracking

Host Intrusion Prevention monitors and handles connections based on the protocol.

Protocol	How protocol is handled
UDP	A UDP connection is added to the state table when a matching static rule is found and the action from the rule is Allow. Generic UDP connections remain in the state table as long as the connection isn't idle longer than the specified timeout period. These connections carry application-level protocols unknown to the firewall.
ICMPv4	Only ICMP Echo Request and Echo Reply message types are tracked. In contrast to the reliable connection-oriented TCP protocol, UDP and ICMPv4 are less reliable, connectionless protocols. To secure these protocols, the firewall considers generic UDP and ICMP connections to be virtual connections. Virtual connections are held only as long as the connection isn't idle longer than the timeout period specified for the connection. Set the timeout for virtual connections in the Firewall Options settings.
TCP	TCP protocol works on the S3-way handshake. The client computer initiates a new connection, sending a packet to its target with a SYN bit set. The target responds by sending a packet to the client with a SYN-ACK bit set. The client responds by sending a packet with an ACK bit set and the stateful connection is established. All outgoing packets are allowed, but only incoming packets that are part of the established connection are allowed. An exception is when the firewall first queries the TCP protocol and adds all pre-existing connections that match the static rules. Pre-existing connections without a matching static rule are blocked. The TCP connection timeout is enforced only when the connection isn't established. A second or forced TCP timeout applies to established TCP connections only. A registry setting controls this timeout, which has a default value of one hour. Every four minutes the firewall queries the TCP stack and discards connections that TCP doesn't report.

Protocol

How protocol is handled

UDP

A UDP connection is added to the state table when a matching static rule is found and the action from the rule is Allow. Generic UDP connections remain in the state table as long as the connection isn't idle longer than the specified timeout period. These connections carry application-level protocols unknown to the firewall.

ICMPv4

Only ICMP Echo Request and Echo Reply message types are tracked.

In contrast to the reliable connection-oriented TCP protocol, UDP and ICMPv4 are less reliable, connectionless protocols. To secure these protocols, the firewall considers generic UDP and ICMP connections to be virtual connections. Virtual connections are held only as long as the connection isn't idle longer than the timeout period specified for the connection. Set the timeout for virtual connections in the Firewall Options settings.

TCP

TCP protocol works on the S3-way handshake.

The client computer initiates a new connection, sending a packet to its target with a SYN bit set.
The target responds by sending a packet to the client with a SYN-ACK bit set.
The client responds by sending a packet with an ACK bit set and the stateful connection is established.

All outgoing packets are allowed, but only incoming packets that are part of the established connection are allowed. An exception is when the firewall first queries the TCP protocol and adds all pre-existing connections that match the static rules. Pre-existing connections without a matching static rule are blocked. The TCP connection timeout is enforced only when the connection isn't established. A second or forced TCP timeout applies to established TCP connections only. A registry setting controls this timeout, which has a default value of one hour. Every four minutes the firewall queries the TCP stack and discards connections that TCP doesn't report.