Flows and Sessions

Flow-based packet processing, which is stateful, requires the creation of sessions. A session is created for the first packet of a flow for the following purposes:

• To store most of the security measures to be applied to the packets of the flow
• To cache information about the state of the flow

  For example, logging and counting information for a flow is cached in its session. (Some stateful firewall screens rely on threshold values that pertain to individual sessions or across all sessions.)

• To allocate required resources for the flow for features such as Network Address Translation (NAT)
• To provide a framework for features such as Application Layer Gateways (ALGs) and firewall features

Most packet processing occurs in the context of a flow, including:

• Management of policies, NAT, zones, and most screens
• Management of ALGs and authentication