Scribd Logo
Upload

Welcome to Scribd!

  • 10 views

    Firewall Technologies

    Uploaded by

    Naveen Akalanka
    Firewalls are used to protect networks and enforce security policies. They act as a single choke point between internal and external networks, allowing traffic to be monitored and filtered. There are different types of firewalls that can filter at various layers, including packet filtering, stateful inspection, application-level gateways, and host-based firewalls. Zone-based policy firewalls divide the network into zones and define security policies for traffic moving between zones. Firewalls provide defenses but should be used as part of a layered security approach.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Firewall Technologies

    Uploaded by

    Naveen Akalanka
    10 views33 pages
    Firewalls are used to protect networks and enforce security policies. They act as a single choke point between internal and external networks, allowing traffic to be monitored and filtered. There are different types of firewalls that can filter at various layers, including packet filtering, stateful inspection, application-level gateways, and host-based firewalls. Zone-based policy firewalls divide the network into zones and define security policies for traffic moving between zones. Firewalls provide defenses but should be used as part of a layered security approach.

    Original Description:

    Firewall Technologies

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Firewalls are used to protect networks and enforce security policies. They act as a single choke point between internal and external networks, allowing traffic to be monitored and filtered. There are different types of firewalls that can filter at various layers, including packet filtering, stateful inspection, application-level gateways, and host-based firewalls. Zone-based policy firewalls divide the network into zones and define security policies for traffic moving between zones. Firewalls provide defenses but should be used as part of a layered security approach.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    10 views33 pages

    Firewall Technologies

    Uploaded by

    Naveen Akalanka
    Firewalls are used to protect networks and enforce security policies. They act as a single choke point between internal and external networks, allowing traffic to be monitored and filtered. There are different types of firewalls that can filter at various layers, including packet filtering, stateful inspection, application-level gateways, and host-based firewalls. Zone-based policy firewalls divide the network into zones and define security policies for traffic moving between zones. Firewalls provide defenses but should be used as part of a layered security approach.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 33

    Firewall Technologies

    HND-Network Security
    The Need For Firewalls
    Internet connectivity is essential, however it creates a
    threat
    Firewalls-
    • Used as a perimeter defence
    – Single choke point to impose security and auditing
    – Insulates the internal systems from external networks
    • Effective means of protecting LANs
    – Inserted between the premises network and the
    Internet to establish a controlled link
    – Can be a single computer system or a set of two or
    more systems working together
    Firewall Access Policy

    Firewalls:
    • Are resistant to attack
    • Are the only transit
    point between
    networks because all
    traffic flows through
    the firewall
    • Enforce the access
    control policy –
    Examples?
    Firewall Filter Characteristics
    Characteristics that a firewall access policy
    could use to filter traffic include:
    • IP address and protocol values
    • Application protocol
    • User identity
    • Network activity
    Types of Firewalls
    Packet Filtering Firewall Application Gateway Firewall

    Stateful Firewall NAT Firewall


    Access Control Lists
    Permitting Traffic - Example
    Packet Filtering Firewall
    Packet Filtering Firewall
    • Two default policies:
    – Discard - prohibit unless expressly
    permitted
    • More conservative, controlled, visible to
    users
    – Forward - permit unless expressly
    prohibited
    • Easier to manage and use but less secure
    Group Exercise: Decide which traffic to allow through
    The following table lists only the most common TCP ports. In the
    table, determine which network service it is and check the boxes in
    the last two columns indicating whether you will allow data using
    this port through the firewall. Explain your decision.

    TCP Port Service Yes No


    Number
    20 FTP (data channel)
    21
    23
    25
    49
    80
    110
    119
    137,138,139
    143
    389
    443
    636
    Packet-Filtering Examples
    Packet Filter Advantages And
    Weaknesses
    • Advantages
    – Simplicity
    – Typically transparent to users and are very fast
    • Weaknesses
    – Cannot prevent attacks that employ application specific
    vulnerabilities or functions
    – Limited logging functionality
    – Do not support advanced user authentication
    – Vulnerable to attacks on TCP/IP protocol bugs
    – Improper configuration can lead to breaches
    Stateful Inspection Firewall
    • Tightens rules for TCP traffic by creating a directory of
    outbound TCP connections
    – There is an entry for each currently established connection
    – Packet filter allows incoming traffic to high numbered
    ports only for those packets that fit the profile of one of
    the entries in this directory
    • Reviews packet information but also records information
    about TCP connections
    – Keeps track of TCP sequence numbers to prevent attacks
    that depend on the sequence number
    – Inspects data for protocols like FTP, IM and SIPS commands
    Stateful Firewalls
    Stateful Firewalls State Tables

    Stateful Firewall Operation

    permit ip 10.0.0.0 0.0.0.255 any Dynamic: permit tcp host 209.165.201.3 eq 80


    host 10.1.1.1 eq 1500
    Example Stateful Firewall
    Connection State Table
    Application-Level Gateway
    • Also called an application proxy
    • Acts as a relay of application-level traffic
    – User contacts gateway using a TCP/IP application
    – User is authenticated
    – Gateway contacts application on remote host and relays
    TCP segments between server and user
    • Must have proxy code for each application
    – May restrict application features supported
    • Tend to be more secure than packet filters
    • Disadvantage is the additional processing overhead on each
    connection
    Host-Based Firewalls
    • Used to secure an individual host
    • Available in operating systems or can be provided
    as an add-on package
    • Filter and restrict packet flows
    • Common location is a server
    • Advantages:
    – Filtering rules can be tailored to the host
    environment
    – Protection is provided independent of topology
    – Provides an additional layer of protection
    Inside and Outside Networks
    Demilitarized Zones
    Zone-Based Policy Firewalls
    Benefits of ZPF

    • Not dependent on ACLs


    • Router security posture is to block unless explicitly allowed
    • Policies are easy to read and troubleshoot One policy affects
    any given traffic, instead of needing multiple ACLs and
    inspection actions
    ZPF Actions

    • Inspect - Configures stateful packet inspections.


    • Drop - Analogous to a deny statement in an ACL.
    A log option is available to log the rejected
    packets.
    • Pass - Analogous to a permit statement in an
    ACL. The pass action does not track the state of
    connections or sessions within the traffic.
    Rules for Transit Traffic
    Configure ZPF
    Step 1: Create Zones
    Step 2: Identify Traffic
    Example class-map Configuration
    Step 3: Define an Action
    Example policy-map
    Configuration
    Step 4: Identify a Zone-Pair and Match
    to a Policy
    Example service-policy
    Configuration
    Step 5: Assign Zones to Interfaces
    Firewall Capabilities And Limits
    • Capabilities:
    – Defines a single choke point
    – Provides a location for monitoring security events
    – Convenient platform for several Internet functions that are not
    security related
    – Can serve as the platform for IPSec
    • Limitations:
    – Cannot protect against attacks bypassing firewall
    – May not protect fully against internal threats
    – Improperly secured wireless LAN can be accessed from outside
    the organization
    – Laptop, PDA, or portable storage device may be infected outside
    the corporate network then used internally
    Layered Defense
    What are the best practices?
    • Position firewalls at security boundaries.
    • It is unwise to rely exclusively on a firewall for security.
    • Deny all traffic by default. Permit only services that are
    needed.
    • Ensure that physical access to the firewall is controlled.
    • Monitor firewall logs.
    • Practice change management for firewall configuration
    changes.
    • Remember that firewalls primarily protect from
    technical attacks originating from the outside.
    Example Firewall
    Configuration
    Summary
    • The need for firewalls
    • Firewall characteristics and access
    policy
    • Types of firewalls
    • Zone-Based Policy Firewalls

    You might also like