L38
Access-control rules and stateful firewalls
Cram this first — memory hook
Who from, where to, which protocol/port, which direction, what action, in what order?
Exam trap
A correct port with the wrong direction or source network is still a wrong rule. Another firewall elsewhere can block the same flow.
The slide facts
Access Control Lists match source, destination, protocol and ports, then allow/deny/log. Rule order, implicit deny and stateful versus stateless handling affect results.
If you have time — extra
An Access Control List () is a set of traffic rules. For the teaching simulator, explicitly use first-match evaluation from top to bottom and deny traffic that matches no allow rule. Real platforms can differ, so do not assume this model for every product. A broad allow placed before a specific deny may make the deny unreachable. Match the source, destination, transport protocol, service port and direction precisely. Stateful firewalls track sessions and can allow valid reply traffic for permitted connections. Stateless filtering evaluates individual packets and may need rules covering both directions, including temporary client ports. A statement such as allow staff to web server Transmission Control Protocol 443 should not accidentally grant guest access to every internal server. Logging and controlled tests explain whether the intended rule actually matched.
Walkthrough
Define required business flows, identify exact endpoints/services, write specific rules in the documented order, include default behavior and return-path handling, test allowed and denied examples, and retain rollback information.