1. Networking Essentials For Firewall-1 Administrators
“What You Need To Know Before The Packets Flow”
Copyright © 2006 Information Engine, Inc. Unsure?

2. Brief Networking Review
1. Networking Protocols
2. IP Protocols
3. The OSI Seven-Layer Networking Model
4. TCP And UDP
5. IP Addresses, Subnet Masks and Routing
6. Address Resolution Protocol (ARP)
7. Putting It All Together
Copyright © 2006 Information Engine, Inc. Unsure?

3. 1. Networking Protocols IP (Internet Protocol)
It’s special for two reasons:
The Official Protocol for the Internet
The Only Protocol Supported By VPN-1/Firewall-1!
IPX (Internetwork Packet eXchange)
AppleTalk
DECnet
NetBEUI
Many, Many Others

4. 2. IP Protocols Some of the Values of the IP Protocol Field:
1: Internet Control Message Protocol (ICMP)
6: Transmission Control Protocol (TCP)
17: User Datagram Protocol (UDP)
50: IP Security Encapsulating Security Payload (ESP)
51: IP Security Authentication Header (AH)

5. 3. The OSI Seven-Layer Networking Model
7. Application
6. Presentation
5. Session
4. Transport 80
3. Network
2. Data Link
00-06-A3-43-E1-F4
1. Physical

6. Why Use The 7 Layer Model? Outbound Packets:
An outbound packet travels down the stack and leaves the IP host from below
At many layers, it gets wrapped in additional headers and a checksum footer

7. Why Use The 7 Layer Model? Inbound Packets:
An inbound packet enters from below and travels up the stack
At many layers, it gets unwrapped and a header and checksum footer gets stripped off

8. Why Use The 7 Layer Model?
Each layer is effectively using the packet to communicate with only the corresponding layer on the partner IP host

9. Where Does Firewall-1 Fit In?
Below Layer 3
Above Layer 2
Both Inbound and Outbound

10. Firewall-1 Does These Things To A Packet
Anti-Spoof Checking:
Uses Source IP Address
Filtering:
Uses both Source and Destination IP Address
Uses both Source and Destination Ports
NAT:
Can change Source or Destination IP Address
Can change Source or Destination Port Number
Routing:
Uses Destination IP Address

11. 4. TCP And UDP TCP: UDP: Connection-oriented
Missed a packet? Please re-send.
Sort of like a phone call
UDP:
Connection-less
Missed a packet? Tough.
Sort of like a radio station

12. Port Numbers Only on TCP and UDP!
Q: How Does Port Address Translation Disambiguate ICMP Traffic?
A: (Discussion)

13. Common Port Numbers HTTP: TCP Port 80 Telnet: TCP Port 23
FTP: TCP Port 21
DNS:
Lookups: UDP Port 53
Zone Transfers: TCP Port 53
SMTP: TCP Port 25
POP3: TCP Port 110

14. 5. IP Addresses, Subnet Masks And Routing
Dotted Quad Notation:
This is only a way to represent 32 bits in a human-friendly format
Example:
| | | ==
205| | | ==

15. Dotted Quad Notation Dotted Quad Notation: Another Example:
| | | ==
255| | | ==

16. The Subnet Mask An IP Address really consists of two contiguous parts:
A Network Number (the first N bits), followed by
A Host ID (the remaining 32-N bits)
Where N is the number of bits in the subnet mask
The bit count always sums to 32 (Assuming IPv4 here)

17. The Two Most Important Subnet Mask Facts
A subnet mask is always a continuous series of 1’s followed by a continuous series of 0’s, with a total count of 32 binary digits
The traditional dotted quad notation for a subnet mask is simply the decimal representation of this 32-bit mask

18. There Are Only 33 Possible Subnet Masks (Page 1 of 5)
| | | /0
| | | /1
| | | /2
| | | /3
| | | /4
| | | /5
| | | /6
| | | /7

19. There Are Only 33 Possible Subnet Masks (Page 2 of 5)
| | | /8
| | | /9
| | |
/10
| | |
/11
| | |
/12
| | |
/13
| | |
/14
| | |
/15

20. There Are Only 33 Possible Subnet Masks (Page 3 of 5)
| | |
/16
| | |
/17
| | |
/18
| | |
/19
| | |
/20
| | |
/21
| | |
/22
| | |
/23

21. There Are Only 33 Possible Subnet Masks (Page 4 of 5)
| | |
/24
| | |
/25
| | |
/26
| | |
/27
| | |
/28
| | |
/29
| | |
/30
| | |
/31

22. There Are Only 33 Possible Subnet Masks (Page 5 of 5)
| | |
/32

23. Why Do We Have Subnet Masks?
So it’s easy to tell whether an IP address is a member of an IP subnet

24. How Does A Router Route?
Step 1. For each IP interface, use the subnet mask to mask both the IP address on the interface and the destination IP address for the packet in hand. If they match, the we’re done with routing and can use Layer 2 (usually Ethernet) to deliver the packet.

25. How Does A Router Route?
Step 2. If this comparison of masked IP addresses fails for every IP interface, then iterate through your routing table to determine the next hop and which interface to use to get there. Then send the packet to this next hop by Ethernet, using ARP if necessary to get the MAC address of the destination NIC.

26. How Does A Router Route?
This business of determining whether to deliver a packet by Layer 2 or route it to its next hop is known as asking yourself: “Do I Route Or Do I Shout?”
“Route” = = “Not in local network, send to next hop”
“Shout” == “Resolve by ARP and send by Layer 2”

27. 6. Address Resolution Protocol (ARP)
Resolves the Forwarding IP Address of a Node to its Corresponding Media Access Control (MAC) Address, typically its Ethernet address
ARP Request Message:
“Any Ethernet host on this segment with the IP address of ?”
ARP Reply Message:
“That’s me, at E-3C-21!”

28. Address Resolution Protocol (ARP)
The ARP Cache Is A RAM-Based Table Of IP-to-MAC Address Mappings
Cisco IOS:
Timeout is 3 Hours
Windows:
Timeout is 2 Minutes
(Renewable Through Use to 10 Minutes)

29. 7. Putting It All Together
Example and Demonstration