| 9.1 |  | Transport Protocols |
| 9.1.3 |  | TCP features and interaction with PIX |

| As was discussed, TCP is a connection-oriented protocol. When a session from a more secure host inside the PIX Security Appliance is started, the PIX Security Appliance creates a log for the session state filter. The PIX Security Appliance is able to extract network sessions from the network flow and actively verify their validity in real time. This stateful filter maintains the state of each network connection and checks subsequent protocol units against its expectations. When TCP initiates a session with the PIX Security Appliance, the PIX Security Appliance records the network flow and looks for an acknowledgement from the device with which it is trying to initiate communications. The PIX Security Appliance then allows traffic to flow between the connections based on the three-way handshake. The step-by-step process is detailed in the demonstration activity.

| Media Activity Demonstration Activity: TCP Initialization Inside to Outside In this activity, students will examine the Firewall TCP initialization process in more detail.