Using another relatively quick way to identify malicious content, circuit-level gateways monitor TCP handshakes and other network protocol session initiation messages across the network as they are established between the local and remote hosts to determine whether the session being initiated is legitimate - whether the remote system is considered trusted. Major Screening happens before the Connection is Established. Instead, circuit-level gateways monitor TCP or UDP sessions. Circuit Level Gateway Firewall: Circuit level gateways are deployed at the Session layer of the OSI model and they monitor sessions like TCP three way handshake to see whether a requested connection is legitimate or not. Doesn't check the payload and can be easily spoofed. Unlike a packet filtering firewall, a circuit-level gateway does not examine individual packets.

However, these firewalls don't route packets rather they compare each packet received to a set of established criteria, such as the allowed IP addresses, packet type, port number and other aspects of the packet protocol headers. Packet filtering firewalls operate inline at junction points where devices such as routers and switches do their work.

Circuit level gateway firewalls