com.amazonaws.services.fms.model

Class StatefulEngineOptions

java.lang.Object

com.amazonaws.services.fms.model.StatefulEngineOptions

All Implemented Interfaces:

StructuredPojo, Serializable, Cloneable

@Generated(value="com.amazonaws:aws-java-sdk-code-generator")
public class StatefulEngineOptions
extends Object
implements Serializable, Cloneable, StructuredPojo

Configuration settings for the handling of the stateful rule groups in a Network Firewall firewall policy.

See Also:

AWS API Documentation, Serialized Form

Constructor Summary

Constructors

Constructor and Description
StatefulEngineOptions()

Method Summary

Modifier and Type	Method and Description
StatefulEngineOptions	clone()
boolean	equals(Object obj)
String	getRuleOrder() Indicates how to manage the order of stateful rule evaluation for the policy.
String	getStreamExceptionPolicy() Indicates how Network Firewall should handle traffic when a network connection breaks midstream.
int	hashCode()
void	marshall(ProtocolMarshaller protocolMarshaller) Marshalls this structured data using the given ProtocolMarshaller.
void	setRuleOrder(String ruleOrder) Indicates how to manage the order of stateful rule evaluation for the policy.
void	setStreamExceptionPolicy(String streamExceptionPolicy) Indicates how Network Firewall should handle traffic when a network connection breaks midstream.
String	toString() Returns a string representation of this object.
StatefulEngineOptions	withRuleOrder(RuleOrder ruleOrder) Indicates how to manage the order of stateful rule evaluation for the policy.
StatefulEngineOptions	withRuleOrder(String ruleOrder) Indicates how to manage the order of stateful rule evaluation for the policy.
StatefulEngineOptions	withStreamExceptionPolicy(StreamExceptionPolicy streamExceptionPolicy) Indicates how Network Firewall should handle traffic when a network connection breaks midstream.
StatefulEngineOptions	withStreamExceptionPolicy(String streamExceptionPolicy) Indicates how Network Firewall should handle traffic when a network connection breaks midstream.

Methods inherited from class java.lang.Object

getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

StatefulEngineOptions

public StatefulEngineOptions()

Method Detail

setRuleOrder

public void setRuleOrder(String ruleOrder)

Indicates how to manage the order of stateful rule evaluation for the policy. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.

Default: DEFAULT_ACTION_ORDER

Parameters:

ruleOrder - Indicates how to manage the order of stateful rule evaluation for the policy. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.

Default: DEFAULT_ACTION_ORDER

See Also:

RuleOrder

getRuleOrder

public String getRuleOrder()

Indicates how to manage the order of stateful rule evaluation for the policy. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.

Default: DEFAULT_ACTION_ORDER

Returns:

Indicates how to manage the order of stateful rule evaluation for the policy. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.

Default: DEFAULT_ACTION_ORDER

See Also:

RuleOrder

withRuleOrder

public StatefulEngineOptions withRuleOrder(String ruleOrder)

Indicates how to manage the order of stateful rule evaluation for the policy. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.

Default: DEFAULT_ACTION_ORDER

Parameters:

ruleOrder - Indicates how to manage the order of stateful rule evaluation for the policy. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.

Default: DEFAULT_ACTION_ORDER

Returns:

Returns a reference to this object so that method calls can be chained together.

See Also:

RuleOrder

withRuleOrder

public StatefulEngineOptions withRuleOrder(RuleOrder ruleOrder)

Indicates how to manage the order of stateful rule evaluation for the policy. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.

Default: DEFAULT_ACTION_ORDER

Parameters:

ruleOrder - Indicates how to manage the order of stateful rule evaluation for the policy. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.

Default: DEFAULT_ACTION_ORDER

Returns:

Returns a reference to this object so that method calls can be chained together.

See Also:

RuleOrder

setStreamExceptionPolicy

public void setStreamExceptionPolicy(String streamExceptionPolicy)

Indicates how Network Firewall should handle traffic when a network connection breaks midstream.

• DROP - Fail closed and drop all subsequent traffic going to the firewall.

• CONTINUE - Continue to apply rules to subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on context. For example, with a stateful rule that drops HTTP traffic, Network Firewall won't match subsequent traffic because the it won't have the context from session initialization, which defines the application layer protocol as HTTP. However, a TCP-layer rule using a flow:stateless rule would still match, and so would the aws:drop_strict default action.

• REJECT - Fail closed and drop all subsequent traffic going to the firewall. With this option, Network Firewall also sends a TCP reject packet back to the client so the client can immediately establish a new session. With the new session, Network Firewall will have context and will apply rules appropriately.

  For applications that are reliant on long-lived TCP connections that trigger Gateway Load Balancer idle timeouts, this is the recommended setting.

• FMS_IGNORE - Firewall Manager doesn't monitor or modify the Network Firewall stream exception policy settings.

For more information, see Stream exception policy in your firewall policy in the Network Firewall Developer Guide.

Default: FMS_IGNORE

Parameters:

streamExceptionPolicy - Indicates how Network Firewall should handle traffic when a network connection breaks midstream.

• DROP - Fail closed and drop all subsequent traffic going to the firewall.

• CONTINUE - Continue to apply rules to subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on context. For example, with a stateful rule that drops HTTP traffic, Network Firewall won't match subsequent traffic because the it won't have the context from session initialization, which defines the application layer protocol as HTTP. However, a TCP-layer rule using a flow:stateless rule would still match, and so would the aws:drop_strict default action.

• REJECT - Fail closed and drop all subsequent traffic going to the firewall. With this option, Network Firewall also sends a TCP reject packet back to the client so the client can immediately establish a new session. With the new session, Network Firewall will have context and will apply rules appropriately.

  For applications that are reliant on long-lived TCP connections that trigger Gateway Load Balancer idle timeouts, this is the recommended setting.

• FMS_IGNORE - Firewall Manager doesn't monitor or modify the Network Firewall stream exception policy settings.

For more information, see Stream exception policy in your firewall policy in the Network Firewall Developer Guide.

Default: FMS_IGNORE

See Also:

StreamExceptionPolicy

getStreamExceptionPolicy

public String getStreamExceptionPolicy()

Indicates how Network Firewall should handle traffic when a network connection breaks midstream.

• DROP - Fail closed and drop all subsequent traffic going to the firewall.

• CONTINUE - Continue to apply rules to subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on context. For example, with a stateful rule that drops HTTP traffic, Network Firewall won't match subsequent traffic because the it won't have the context from session initialization, which defines the application layer protocol as HTTP. However, a TCP-layer rule using a flow:stateless rule would still match, and so would the aws:drop_strict default action.

• REJECT - Fail closed and drop all subsequent traffic going to the firewall. With this option, Network Firewall also sends a TCP reject packet back to the client so the client can immediately establish a new session. With the new session, Network Firewall will have context and will apply rules appropriately.

  For applications that are reliant on long-lived TCP connections that trigger Gateway Load Balancer idle timeouts, this is the recommended setting.

• FMS_IGNORE - Firewall Manager doesn't monitor or modify the Network Firewall stream exception policy settings.

For more information, see Stream exception policy in your firewall policy in the Network Firewall Developer Guide.

Default: FMS_IGNORE

Returns:

Indicates how Network Firewall should handle traffic when a network connection breaks midstream.

• DROP - Fail closed and drop all subsequent traffic going to the firewall.

• CONTINUE - Continue to apply rules to subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on context. For example, with a stateful rule that drops HTTP traffic, Network Firewall won't match subsequent traffic because the it won't have the context from session initialization, which defines the application layer protocol as HTTP. However, a TCP-layer rule using a flow:stateless rule would still match, and so would the aws:drop_strict default action.

• REJECT - Fail closed and drop all subsequent traffic going to the firewall. With this option, Network Firewall also sends a TCP reject packet back to the client so the client can immediately establish a new session. With the new session, Network Firewall will have context and will apply rules appropriately.

  For applications that are reliant on long-lived TCP connections that trigger Gateway Load Balancer idle timeouts, this is the recommended setting.

• FMS_IGNORE - Firewall Manager doesn't monitor or modify the Network Firewall stream exception policy settings.

For more information, see Stream exception policy in your firewall policy in the Network Firewall Developer Guide.

Default: FMS_IGNORE

See Also:

StreamExceptionPolicy

withStreamExceptionPolicy

public StatefulEngineOptions withStreamExceptionPolicy(String streamExceptionPolicy)

Indicates how Network Firewall should handle traffic when a network connection breaks midstream.

• DROP - Fail closed and drop all subsequent traffic going to the firewall.

• CONTINUE - Continue to apply rules to subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on context. For example, with a stateful rule that drops HTTP traffic, Network Firewall won't match subsequent traffic because the it won't have the context from session initialization, which defines the application layer protocol as HTTP. However, a TCP-layer rule using a flow:stateless rule would still match, and so would the aws:drop_strict default action.

• REJECT - Fail closed and drop all subsequent traffic going to the firewall. With this option, Network Firewall also sends a TCP reject packet back to the client so the client can immediately establish a new session. With the new session, Network Firewall will have context and will apply rules appropriately.

  For applications that are reliant on long-lived TCP connections that trigger Gateway Load Balancer idle timeouts, this is the recommended setting.

• FMS_IGNORE - Firewall Manager doesn't monitor or modify the Network Firewall stream exception policy settings.

For more information, see Stream exception policy in your firewall policy in the Network Firewall Developer Guide.

Default: FMS_IGNORE

Parameters:

streamExceptionPolicy - Indicates how Network Firewall should handle traffic when a network connection breaks midstream.

• DROP - Fail closed and drop all subsequent traffic going to the firewall.

• CONTINUE - Continue to apply rules to subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on context. For example, with a stateful rule that drops HTTP traffic, Network Firewall won't match subsequent traffic because the it won't have the context from session initialization, which defines the application layer protocol as HTTP. However, a TCP-layer rule using a flow:stateless rule would still match, and so would the aws:drop_strict default action.

• REJECT - Fail closed and drop all subsequent traffic going to the firewall. With this option, Network Firewall also sends a TCP reject packet back to the client so the client can immediately establish a new session. With the new session, Network Firewall will have context and will apply rules appropriately.

  For applications that are reliant on long-lived TCP connections that trigger Gateway Load Balancer idle timeouts, this is the recommended setting.

• FMS_IGNORE - Firewall Manager doesn't monitor or modify the Network Firewall stream exception policy settings.

For more information, see Stream exception policy in your firewall policy in the Network Firewall Developer Guide.

Default: FMS_IGNORE

Returns:

Returns a reference to this object so that method calls can be chained together.

See Also:

StreamExceptionPolicy

withStreamExceptionPolicy

public StatefulEngineOptions withStreamExceptionPolicy(StreamExceptionPolicy streamExceptionPolicy)

Indicates how Network Firewall should handle traffic when a network connection breaks midstream.

• DROP - Fail closed and drop all subsequent traffic going to the firewall.

• CONTINUE - Continue to apply rules to subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on context. For example, with a stateful rule that drops HTTP traffic, Network Firewall won't match subsequent traffic because the it won't have the context from session initialization, which defines the application layer protocol as HTTP. However, a TCP-layer rule using a flow:stateless rule would still match, and so would the aws:drop_strict default action.

• REJECT - Fail closed and drop all subsequent traffic going to the firewall. With this option, Network Firewall also sends a TCP reject packet back to the client so the client can immediately establish a new session. With the new session, Network Firewall will have context and will apply rules appropriately.

  For applications that are reliant on long-lived TCP connections that trigger Gateway Load Balancer idle timeouts, this is the recommended setting.

• FMS_IGNORE - Firewall Manager doesn't monitor or modify the Network Firewall stream exception policy settings.

For more information, see Stream exception policy in your firewall policy in the Network Firewall Developer Guide.

Default: FMS_IGNORE

Parameters:

streamExceptionPolicy - Indicates how Network Firewall should handle traffic when a network connection breaks midstream.

• DROP - Fail closed and drop all subsequent traffic going to the firewall.

• CONTINUE - Continue to apply rules to subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on context. For example, with a stateful rule that drops HTTP traffic, Network Firewall won't match subsequent traffic because the it won't have the context from session initialization, which defines the application layer protocol as HTTP. However, a TCP-layer rule using a flow:stateless rule would still match, and so would the aws:drop_strict default action.

• REJECT - Fail closed and drop all subsequent traffic going to the firewall. With this option, Network Firewall also sends a TCP reject packet back to the client so the client can immediately establish a new session. With the new session, Network Firewall will have context and will apply rules appropriately.

  For applications that are reliant on long-lived TCP connections that trigger Gateway Load Balancer idle timeouts, this is the recommended setting.

• FMS_IGNORE - Firewall Manager doesn't monitor or modify the Network Firewall stream exception policy settings.

For more information, see Stream exception policy in your firewall policy in the Network Firewall Developer Guide.

Default: FMS_IGNORE

Returns:

Returns a reference to this object so that method calls can be chained together.

See Also:

StreamExceptionPolicy

toString

public String toString()

Returns a string representation of this object. This is useful for testing and debugging. Sensitive data will be redacted from this string using a placeholder value.

Overrides:

toString in class Object

Returns:

A string representation of this object.

See Also:

Object.toString()

equals

public boolean equals(Object obj)

Overrides:

equals in class Object

hashCode

public int hashCode()

Overrides:

hashCode in class Object

clone

public StatefulEngineOptions clone()

Overrides:

clone in class Object

marshall

public void marshall(ProtocolMarshaller protocolMarshaller)

Description copied from interface: StructuredPojo

Marshalls this structured data using the given ProtocolMarshaller.

Specified by:

marshall in interface StructuredPojo

Parameters:

protocolMarshaller - Implementation of ProtocolMarshaller used to marshall this object's data.