| 9.4 |  | Connections |
| 9.4.1 |  | Two ways through the PIX security appliance |

| Now that translations have been covered, this course will look at connections. As was pointed out earlier in this module, connections refer to individual TCP or UDP sessions that have been established across a network. Connections occur at Layer 4 and are actually a subset of translations.

For a packet to cross through the PIX Security Appliance, it must pass two policies, which are NAT and access control. There are two ways to pass these policies and gain access through the PIX Security Appliance :

1. Valid user requests - All inside-to-outside-originated sessions first dynamically populate the translation table. When an outside server responds to the request, the PIX Security Appliance checks the translation table to see if a translation slot exists for that particular request. If it exists, the PIX Security Appliance allows the session to continue. After the session is terminated, the translation slot is deleted.
2. Predefined statics and conduits - Used for outside to inside communication. A predefined static translation is entered using an address or range of addresses from the global pool. A conduit is entered that defines the address, group of addresses, TCP/UDP port or range of ports, and who and what applications are allowed to flow through the PIX Security Appliance.

After a session is established for UDP requests, a configurable timer is set. The session finishes based on the time allowed for the UDP session and then closes the translation slot.