1
Overview
10
Logical objects
You
can
consider
logical
objects
to
be
predefined
building
blocks
for
use
in
rule
sets.
For
example,
the
address
book
contains
named
objects
representing
host
and
network
addresses.
Another
example
of
logical
objects
are
services
that
represent
specific
protocol
and
port
combinations.
SEG rule sets
Finally,
rules
which
are
defined
by
the
administrator
in
the
various
rule
sets
are
used
for
actually
implementing
SEG
security
policies.
The
most
fundamental
set
of
rules
are
the
IP
Rules
,
which
are
used
to
define
Layer
3
IP
filtering
policies.
Basic packet flow
This
section
outlines
the
basic
flow
for
packets
received
and
forwarded
by
the
SEG.
The
following
description
is
simplified
and
might
not
be
fully
applicable
in
all
scenarios,
however,
the
basic
principles
will
be
valid
for
all
SEG
deployments.
1. An
Ethernet
frame
is
received
on
one
of
the
Ethernet
interfaces
in
the
system.
Basic
Ethernet
frame
validation
is
performed
and
the
packet
is
dropped
if
the
frame
is
invalid.
2. The
IP
datagram
within
the
packet
is
passed
on
to
the
SEG
consistency
checker.
The
checker
performs
a
number
of
consistency
checks
on
the
packet,
including
validation
of
checksums,
protocol
flags,
packet
length
and
so
on.
If
the
consistency
checks
fail,
the
packet
gets
dropped
and
the
event
is
logged.
3. The
SEG
now
tries
to
look
up
an
existing
flow
by
matching
parameters
from
the
incoming
packet.
A
number
of
parameters
are
used
in
the
match
attempt,
including
the
source
interface,
source
and
destination
IP
addresses,
and
IP
protocol.
If
a
match
cannot
be
found,
a
flow
establishment
process
starts.
4. The
Access
Rules
are
evaluated
to
find
out
if
the
source
IP
address
of
the
new
flow
is
allowed
on
the
received
interface.
If
no
Access
Rule
matches
then
a
reverse
route
lookup
will
be
done
in
the
routing
tables.
In
other
words,
by
default,
an
interface
will
only
accept
source
IP
addresses
that
belong
to
networks
routed
over
that
interface.
A
reverse
lookup
means
that
a
lookup
is
done
in
the
routing
tables
to
confirm
that
a
route
exists
that
would
route
traffic
destined
for
the
IP
address
over
that
interface.
If
the
Access
Rule
lookup
determines
that
the
source
IP
is
invalid,
the
packet
is
dropped
and
the
event
is
logged.
5. A
route
lookup
is
made
using
the
routing
table.
The
destination
interface
for
the
flow
has
now
been
determined.
