PCI-1.3.4:

Examine firewall and router configurations to verify that connections are restricted between publicly accessible servers and components storing cardholder data, as follows:

• Determine that the firewall performs stateful inspection. Only established connections should be allowed in, and only if they are associated with a previously established session.

Testing Guidance:
Engage a port scanner such as [NMAP] on all TCP and UDP ports with “syn reset” or ”syn ack” bits set.

• A response means packets are allowed through even if they are not part of a previously established session.

--Mdpeters 08:50, 27 February 2007 (EST)