A branch router's stateless inbound ACL on its internet link drops the replies to users' outbound HTTPS sessions. The engineer replaces it with a stateful firewall whose only rule permits outbound HTTPS from inside users. Why do the replies now reach the users?
Select an answer to reveal the explanation.
Short Explanation
A stateful firewall works like a coat check: when you hand in your coat (the outbound connection) you get a ticket, and only the person holding that ticket gets a coat back. The return traffic matches an entry the firewall already wrote down. The trap is thinking it opens a whole range of ports, which is exactly what a stateless ACL forces you to do.
Full Explanation
A stateless ACL evaluates each packet on its own, so replies arriving from the internet must be matched by an explicit inbound rule, often by permitting broad ephemeral port ranges. A stateful firewall instead maintains a connection table. When an inside host opens a permitted outbound TCP 443 session, the firewall records the source and destination addresses, ports and TCP state. Inbound packets are then compared with that table, and those belonging to an established connection are allowed without needing an inbound rule, while unsolicited inbound packets are dropped by the default policy. Opening all high-numbered ports inbound is the workaround stateless filtering requires, and it would expose inside hosts to unsolicited connections; a stateful device avoids it. Rewriting the source port of replies is not how state tracking works; reply source ports already are 443, and the match is made against the stored connection tuple, not by altering packets to fit a rule. Accepting any packet with ACK set is the weaker established keyword on stateless ACLs, which can be abused by crafted packets; true state tracking requires a matching table entry. Exam caveat: UDP and ICMP are tracked as pseudo-connections with timeouts. Operational check: inspect the firewall's connection table during a user session to see the entry matching the replies.