A stateful firewall (SFW) tracks the state of active network connections in a session table, verifying Layer 2 through Layer 4 packet information – addresses, ports, and protocol – against established sessions before allowing, denying, or rejecting the traffic that matches.
Key takeaways
- Tracks connections in a session table instead of judging each packet alone.
- Matches Layer 2–4 headers against established sessions to allow, deny, or reject.
- Cheaper to run than deep inspection – only initiating packets need full checks.
- On Versa VOS, SFW is a per-tenant alternative to NGFW, not layered with it.
- Configured through ordered security access policies with match rules and actions.
On this page: Why it mattersHow it worksTypesStateful firewall & VersaFAQ
Why is a stateful firewall important?
Before stateful inspection, firewalls filtered packets one at a time against static rules, with no memory of whether a packet belonged to an already-permitted conversation – weak, since spoofed packets could mimic an allowed exchange, and slow, since every packet needed full evaluation. Stateful firewalls fixed both with a session table: once a connection is permitted, later packets are checked against the table instead of the whole policy, closing off traffic that doesn’t belong to a real, tracked session.
That mix of stronger enforcement and lower overhead made stateful inspection the baseline for any firewall, and why next-generation firewalls still run a stateful engine underneath their Layer 7 features rather than replacing it. The state table also unlocks richer policy: rules can key off session behavior, zones, and time of day, not just IP-and-port pairs.
What is a stateful firewall?
A stateful firewall classifies traffic by destination port, then tracks its state across every interaction until the connection closes. When a packet arrives, the firewall checks its session table for an established connection or a matching request; if nothing matches, the packet is evaluated against the access policy instead.
That policy is an ordered set of rules combining match criteria – IP headers, domain names, services by port and protocol, source and destination zones, geographic location, and time-of-day scheduling – with enforcement actions: logging (start, end, both, or never) and a disposition (allow, deny, or reject with a TCP reset or ICMP port-unreachable message). Rules evaluate in order and the first match wins, so specific rules come before generic ones – after that, packets matching a tracked session pass with far less processing than a full re-inspection.
Types of stateful firewalls
Three broad patterns exist. Traditional stateful packet inspection (SPI) is the classic model: pure Layer 3/4 session tracking against a state table, with no application-content awareness. Hybrid stateful firewalls with ALG support add narrow application-layer help – an Application Layer Gateway understands protocols like FTP or SIP that open dynamic secondary connections, tracking those without full deep packet inspection. Virtual and software-based stateful firewalls decouple the function from dedicated hardware, running as a virtual network function on an SD-WAN edge device or cloud instance instead – the model most SASE platforms use today.
Stateful firewall & Versa
VOS offers stateful firewall as one of two firewall modes per tenant, alongside next-generation firewall (NGFW); a tenant runs one or the other – if a license includes NGFW, the stateful firewall options don’t appear in the Director GUI. Setup follows the same model on either path: see Configure Stateful Firewall for the standard flow, or Configure Stateful Firewall (NGFW) for the equivalent path on NGFW-licensed devices. VOS also pairs an Application Layer Gateway with stateful firewall for protocols like FTP and SIP, and since VOS doesn’t decrypt QUIC, administrators must block QUIC traffic for the security modules to work correctly.
Because VOS supports multitenancy, stateful firewall can be enabled for one tenant while another runs NGFW, through subscription plans such as Default-Stateful-FW-Plan or Default-SFW-IPSEC-CGNAT-Plan that pair it with services like IPsec and CGNAT. Stateful firewall has shipped since Release 20.2.
Frequently asked questions
What is the difference between a stateful firewall and a next-generation firewall (NGFW)?
A stateful firewall inspects Layer 2 through Layer 4 information – addresses, ports, and session state. An NGFW adds Layer 7 application awareness, such as deep packet inspection and application identification. On Versa VOS, SFW and NGFW are licensed per-tenant alternatives, not stacked together.
What is a stateless firewall, and how does it differ?
A stateless firewall evaluates every packet independently against static rules, with no memory of earlier packets in the connection. A stateful firewall instead records each connection in a session table, so only the first packet needs full rule evaluation against the policy.
What is a session table (state table)?
A state table records each active connection – source and destination addresses, ports, protocol, and connection status. Every arriving packet is checked against the table first; only packets that don’t match an existing entry are evaluated against the full access policy.
Can a stateful firewall stop application-layer threats?
Only to a limited extent. Base inspection stops at Layer 4, though Application Layer Gateways extend it to protocols like FTP and SIP that open secondary connections. Detecting malware, exploits, or threats hidden in encrypted traffic requires the Layer 7 inspection an NGFW provides.
How does a rejected connection differ from a denied one?
A deny action silently drops matching packets with no reply to the sender. A reject action also drops the packets, but sends a TCP reset or an ICMP port-unreachable message back, so the sender learns immediately instead of waiting for a timeout.
More on stateful firewalls
If you want to learn more, these are sources we trust.
| NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy | NIST Computer Security Resource Center: Glossary |
|---|---|
| NIST’s guidance on firewall technologies and policy, including stateful inspection as a core perimeter-defense architecture. | NIST’s reference definitions for network-security terms – useful for pinning down state-table terminology precisely. |
Related terms
If you’re reading about stateful firewalls, these are worth looking at next.
| SD-WAN | Branch | Secure Access Service Edge |
|---|---|---|
| The encrypted-overlay networking approach that carries the traffic a Versa stateful firewall inspects and enforces policy on. | A site running a VOS device, where stateful firewall access policies are configured and enforced against traffic. | The converged security-and-networking architecture where NGFW and stateful firewall are alternative enforcement options. |