1 Firewalls Types of Firewalls Inspection Methods  Static Packet Inspection  Stateful Packet Inspection  NAT  Application Firewalls Firewall Architecture Configuring, Testing, and Maintenance

2 Figure 5-8: Stateful Inspection Firewalls State of Connection: Open or Closed  State: Order of packet within a dialog  Often simply whether the packet is part of an open connection

3 Figure 5-8: Stateful Inspection Firewalls Stateful Firewall Operation  For TCP, record two IP addresses and port numbers in state table as OK (open) (Figure 5-9)  By default, permit connections from internal clients (on trusted network) to external servers (on untrusted network) This default behavior can be changed with an ACL  Accept future packets between these hosts and ports with little or no inspection

4 Figure 5-9: Stateful Inspection Firewall Operation I External Webserver Internal Client PC TCP SYN Segment From: :62600 To: :80 2. Establish Connection 3. TCP SYN Segment From: :62600 To: :80 Stateful Firewall Type TCP Internal IP Internal Port External IP External Port 80 Status OK Connection Table Note: Outgoing Connections Allowed By Default

5 Figure 5-9: Stateful Inspection Firewall Operation I External Webserver Internal Client PC TCP SYN/ACK Segment From: :80 To: : Check Connection OK 4. TCP SYN/ACK Segment From: :80 To: :62600 Stateful Firewall Type TCP Internal IP Internal Port External IP External Port 80 Status OK Connection Table

6 Figure 5-8: Stateful Inspection Firewalls Stateful Firewall Operation  For UDP, also record two IP addresses in port numbers in the state table Type TCP UDP Internal IP Internal Port External IP External Port Status OK Connection Table

7 Figure 5-8: Stateful Inspection Firewalls Static Packet Filter Firewalls are Stateless  Filter one packet at a time, in isolation  If a TCP SYN/ACK segment is sent, cannot tell if there was a previous SYN to open a connection  But stateful firewalls can (Figure 5-10)

8 Figure 5-10: Stateful Firewall Operation II Attacker Spoofing External Webserver Internal Client PC Stateful Firewall 2. Check Connection Table: No Connection Match: Drop 1. Spoofed TCP SYN/ACK Segment From: :80 To: :64640 Type TCP UDP Internal IP Internal Port External IP External Port Status OK Connection Table

9 Figure 5-8: Stateful Inspection Firewalls Static Packet Filter Firewalls are Stateless  Filter one packet at a time, in isolation  Cannot deal with port-switching applications  But stateful firewalls can (Figure 5-11)

10 Figure 5-11: Port-Switching Applications with Stateful Firewalls External FTP Server Internal Client PC TCP SYN Segment From: :62600 To: :21 2. To Establish Connection 3. TCP SYN Segment From: :62600 To: :21 Stateful Firewall Type TCP Internal IP Internal Port External IP External Port 21 Status OK State Table Step 2

11 Figure 5-11: Port-Switching Applications with Stateful Firewalls External FTP Server Internal Client PC TCP SYN/ACK Segment From: :21 To: :62600 Use Ports 20 and for Data Transfers 5. To Allow, Establish Second Connection 4. TCP SYN/ACK Segment From: :21 To: :62600 Use Ports 20 and for Data Transfers Stateful Firewall Type TCP Internal IP Internal Port External IP External Port Status OK State Table Step 2 Step 5

12 Figure 5-8: Stateful Inspection Firewalls Stateful Inspection Access Control Lists (ACLs)  Primary allow or deny applications  Simple because probing attacks that are not part of conversations do not need specific rules because they are dropped automatically  In integrated firewalls, ACL rules can specify that messages using a particular application protocol or server be authenticated or passed to an application firewall for inspection