Engineering reference
What the model represents
42 stages, 77 directed branches, 38 scenarios and 58 representative packet checkpoints. Every displayed edge is exercised by at least one included trace.
Five logical columns
| Column | Responsibilities |
|---|---|
| Ingress | Parsing, inspection eligibility, tunnel decapsulation, IP reassembly, early discard and local/held handling. |
| Session setup | Zone Protection, initial TCP checks, forwarding and NAT lookups, User-ID, DoS policy, firewall Security policy lookup, session installation. |
| Fast path | Session lookup, L2–L4/TCP state, stored NAT, TCP reassembly, SSL proxy gate, application-state decision and content eligibility. |
| App / content | Override/signature lookup, app-based Security policy, profiles/QoS classification, decryption/proxy setup, inspection, app changes, profile actions and re-encryption. |
| Egress | Forwarding, QoS shaping, MTU/DF decisions, IPv4 fragmentation, tunnel encapsulation, outer route lookup and transmission. |
After DoS policy, permitted setup proceeds to firewall Security policy lookup. After SSL proxy processing, an unresolved application with payload enters App-ID; a known application proceeds to content eligibility. Pure handshake packets can bypass payload inspection. Decoder-discovered application changes return to application-aware Security policy. These branches preserve the distinction between first-packet setup and established-session processing.
Included scenario families
- Datacenter connections: public DNAT, DMZ-to-application HTTPS, application-to-database PostgreSQL and Security policy denial.
- TLS and applications: proxy setup and record decryption, inner App-ID, application changes, application policy denial, custom override and decoder assistance.
- Content and identity: alert/drop/reset actions and authentication-portal handling.
- Tunnels and packet handling: IPsec ingress/egress, decapsulation failures, IP fragments, TCP buffering and reassembly errors.
- Egress and NAT: shaping, MTU/DF behavior, fragmentation, SNAT with reverse translation and allocation failure.
- Protection and validation: Zone Protection, DoS, non-SYN new flows, no route, exhausted capacity, discard-state sessions, malformed headers, FIN and a specific L2 non-IP bypass case.