Firewall Basics Technology and Business Applications

Purpose Goals –IP basics –Firewall Placement –Firewall Types/Functions –Customer Needs –Business Case

IP communication Each machine must have a unique address Understanding the Tech

Each machine must also transmit and/or receive on a unique TCP or UDP port Port 1 Port 65,535 Port 1 Port 65,535 Understanding the Tech

Port 1 Port 65,535 Port 1 Port 65,535 In the Beginning, There were Routers with Access Control Lists (ACL) If you come from address , You may pass. Understanding the Tech

But ACLs did not do the job Spoofing- a packet crafted to appear to be from a trusted source Fragmentation- an IP packet is split into many pieces requiring reassembly at the destination –Offset overwrites Header replacement Payload replacement –Giant Packets –Scrambled Sequences –Fragment retransmission Understanding the Tech

Later on, Port source and destination filters were also added to ACLs Destination Port 21 Source Port 21 If you come from address , AND you have a source port of 21, AND you have a destination port of 21, You may pass. Understanding the Tech

Still not good enough... Simple Spoofing defeated, but... –Fragmentation techniques still effective Protocol impersonation “Mangled” packets Bounce attacks Hijacking Complexity exceeded benefit Understanding the Tech

Stateful Inspection added additional security by tracking the “state” of TCP traffic. Source Port 21 Destination Port 21 Understanding the Tech

Still not good enough Man in the Middle Sequence Healing Direct Connection exists Payload still not checked for protocol or syntax

Enter the Application Gateway (Proxy) Architecture

Traffic originates from The first connection is to the Proxy’s NIC A second, unique connection is made by the Proxy device to Proxy Firewall ALL traffic is stripped of its layer headers. Payload is analyzed at the application layer. Brand new headers are created by the Proxy and pre-pended to application traffic

Advantages to Proxy Spoof-proof Frag-proof Syntax checking No protocol masquerading Detailed logging

3 Major Disadvantages to Proxy and 1 minor Speed –“It’s too hard!”

Trump Card- Adaptive Proxy Initial connection sequence is full proxy “One time” packet screening rule created to pass following traffic Connection teardown removes the One time rule –Result: “The security of Proxy with the Speed of the Packet Filter.”

Firewall Placement Traditional –Perimeter Internal Segmentation Gateway –Exclusive –Non-exclusive Tiered

Things that make Firewalls Difficult Domain Name Service (DNS) –Canonical to IP and reverse Simple Mail Transport Protocol (SMTP) Network Address Translation (NAT) –Legal –Illegal

Things That Make Firewalls Difficult- cont. Virtual Private Networks –Older methods intolerant of NAT –Certificates involve PKI overhead –Historically complex integration with so-called compliant products –Sparse technical competence –Multiple types Trusted Private Pass through