Firewalls Types of Firewalls Inspection Methods Firewall Architecture Configuring, Testing, and Maintenance
Figure 5-22: Configuring, Testing, and Maintaining Firewalls Firewall Misconfiguration is a Serious Problem ACL rules must be executed in series Easy to make misordering problems Easy to make syntax errors
Figure 5-22: Configuring, Testing, and Maintaining Firewalls Create Policies Before ACLs Policies are easier to read than ACLs Can be reviewed by others more easily than ACLs Policies drive ACL development Policies also drive testing
Figure 5-22: Configuring, Testing, and Maintaining Firewalls Must test Firewalls with Security Audits Only way to tell if policies are being supported Must be driven by policies Maintaining Firewalls New threats appear constantly ACLs must be updated constantly if firewall is to be effective
Figure 5-23: FireWall-1 Modular Management Architecture Log Files Policy Policy Firewall Module Enforces Policy Sends Log Entries Application Module (GUI) Create, Edit Policies Management Module Stores Policies Stores Log Files Log File Entry Log File Data Firewall Module Enforces Policy Sends Log Entries Application Module (GUI) Read Log Files
Figure 5-24: FireWall-1 Service Architecture 2. Statefully Filtered Packet 1. Arriving Packet 3. DoS Protection Optional Authentications Internal Client External Server FireWall-1 Firewall 4. Content Vectoring Protocol 5. Statefully Filtered Packet Plus Application Inspection Third-Party Application Inspection Firewall
Figure 5-25: Security Level-Based Stateful Filtering in PIX Firewalls Automatically Accept Connection Internet Security Level Inside=100 Security Level Outside=0 Router Automatically Reject Connection Internal Network Security Level=60 Connections Are Allowed from More Secure Networks to Less Secure Networks
Figure 5-21: Other Security Architecture Issues Host and Application Security (Chapters 6 and 9) Antivirus Protection (Chapter 4) Intrusion Detection Systems (Chapter 10) Virtual Private Networks (Chapter 8) Policy Enforcement System