Stateful vs stateless firewall: what’s the difference and why does it matter?

When you’re starting out in IT services, there’s a lot of complex lingo to learn! Firewalls are no exception. They can be a pretty complicated subject for IT experts and beginners alike. So if you’re asking yourself; “what is a stateful vs stateless firewall?”, we’re here to help!

In this article, you’ll learn what stateful and stateless firewalls are, the major differences that distinguish the two, and the pros and cons of each choice for your IT business.

What is a stateless firewall?

With the stateless firewall, it’s all in the name. A stateless firewall uses the stateless protocol, and therefore doesn’t remember any previous state of data packets. Stateless firewalls filters the packet that’s passing through the firewall in real-time according to a rule list, held client-side. Each data communication is effectively in a silo.

Rules could be anything from the destination or source address, or anything in the header of the packet contents, and this will determine whether the traffic is permitted into the network, or denied access. This type of firewall is also known as a packet filtering firewall, and an example of it in action is the Extended Access Control Lists on Cisco IOS Routers.

What is a stateful firewall?

Just as its name suggests, a stateful firewall remembers the state of the data that’s passing through the firewall, and can filter according to deeper information than its stateless friend. It will monitor all the parts of a traffic stream, including TCP connection stages, status updates, and previous packet activity.

After a type of traffic has been approved, it will be added to a kind of database (known as a state table or a connection table) so that the stateful firewall works to make intelligent decisions about these kinds of packets in the future. This type of firewall is also called a dynamic packet filtering firewall, and an example is the Microsoft Defender Firewall, often the default choice for PC users.

Why do IT businesses choose stateless firewalls?

If you look at the descriptions of both kinds of firewall, you’re probably thinking that a stateful firewall seems like the smarter choice. And it’s true–a stateful firewall can do a lot more than a stateless firewall. It can channel data packets with more insight and context, provide a more robust deterrent to cyberattacks, and retain memory on previous behaviors.

However, it’s not as simple as that. Some people note that stateful firewalls are more prone to cyberattacks as they require a lot of resources to run, and you can also experience more issues through man-in-the-middle attacks, where an attacker stands in the middle between two sides communicating, and intercepts or changes the communication without either party realizing.

You also need to ensure you have a tight patch management schedule for your firewall, as a gap can cause vulnerabilities that hackers and bad actors can take advantage of to wreak havoc on your network. A great way to stay on top of your patch management is by automating it, which can be done through an RMM software that offers automated patch management.

And it’s not only about the risks of using stateful firewalls, either. There are some pros in the stateless firewall column! On the side of stateless firewalls, key benefits include really fast performance even when there is heavy traffic or unexpected spikes in data packets, and usually a cheaper price tag. These are valuable benefits that might make all the difference.

How do I know if I need a stateful or a stateless firewall?

With pros and cons on both sides, it’s hard to know which one is the right choice. It might help to ask yourself these three questions:

• Does my business need this firewall to inspect traffic?
• Do I need my firewall to have a memory, and act based on previous packet information?
• Am I looking for extensive logging and attack prevention from this firewall?

If the answer to these questions is yes, then you’re looking for a stateful firewall. If not, a stateless firewall might well do the trick. In practice, most small businesses are generally okay to just use a stateless firewall, but the bigger the enterprise the more likely you are to need to invest in something with a few more bells and whistles.

However, there are some exceptions. For example, an IT department managing the network of a large company might be in charge of a complex data center with some form of segmentation using VLANs or microsegmentation. In which case, you might want to use a stateless firewall internally between two parts of the data center, knowing that your next-gen firewall or your stateful firewall is protecting a perimeter.

Making a final decision for MSP clients on stateful versus stateless firewalls

As cyberattacks continue to rise, and MSPs are called upon to protect multiple client environments, it’s important to understand and describe the different kinds of firewalls that you should deploy to inspect traffic and communications. This is an important conversation to have with your clients, whether you’re onboarding them to your services, providing a security workshop, or a TBR (Technology Business Review.)

While stateful firewalls are smarter, have deeper functionality, and are able to retain information about previous packets based on network context, they are also more prone to cyberattack, and take up greater resources.

For a faster data rate with more simplicity of operations and a great level of performance, especially where your client has more trust for the packet data or doesn’t need the firewall to inspect the traffic deeply, a stateless firewall may well be the better choice.

For IT departments, you’ll need to evaluate the structure, as well as specific needs of your network. If you work within an IT department of a large organization, more often than not, you’ll need to use a combination of stateful and stateless firewalls. For example, you may use a stateless firewall internally between different pieces of your data center, but a stateful firewall at the network perimeter to avoid harmful attacks. 

Each situation will be unique, and as such you’ll need to approach each firewall by considering its unique circumstances

Transform your IT game with Atera

Want more guides like this on common IT terms and how to make the right choices for your business and your client environments? Check out the Atera blog, where we take complicated IT topics, and distill them into easy-to-read, helpful blog posts.

Ready to take our all-inclusive RMM program for a whirl? With our 30-day free trial, you can be experiencing what we have to offer to the fullest extent, with no credit card required.