1. Appliance Firewalls A Technology Review By: Brent Huston bhuston@microsolved.com T h e B l a c k H a t B r i e f i n g s July 7-8, 1999 Las Vegas

2. Disclaimer Product names contained within are the copyright and trademark of their respective companies. For company names, please see the last slide of this presentation.

3. Agenda What is an appliance firewall? What technologies do they employ? What were we looking for? The successes we had The problems we discovered The future of network appliances Summary of information

4. What is an appliance firewall? Integrated hardware solution All software, including OS comes pre-loaded on the platform Network “black box” approach to security

5. Evolution Originated as firewall features added to routers Basic packet filtering –Source, Dest., Protocol Application specific proxies “Stateful Inspection” Appliance firewalls

6. What technologies do they employ? Network Address Translation (NAT) Most use packet filtering rules to determine packet access Some use “stateful inspection” to manage connections Some application proxy support –A few allow custom proxy creation *BONUS*

7. Some Have Other Helpful Features Built in application servers - mail, web, ftp DHCP support Built-in VPN capability - p2p and client based Strong authentication support URL/content blocking DMZ configuration Email alerting SNMP support

8. Management Functions Web based was easiest to use and allowed greatest flexibility Custom applications provided some ease, but lacked true remote management ability Direct cable solutions were poor and inflexible Worst case was a direct custom cable via SLIP

9. Our Mock Deployment Goal: Locate an appliance firewall that could protect our medium size business (500 users) from the Internet –Ease of deployment and management –Provide adequate security for internal systems –Allow external access to our mail and web servers –Alert us in the event of an attack

10. “Bonus” Features Good documentation Ease of maintenance Real time reports Content blocking SNMP alerting VPN between branches Failure recovery

11. Our Security Desires Extensive logging of successful connections, rejected packets and suspected attacks Immunity to Denial of Service attacks Protection against information gathering probes Initial deny all ruleset for access

12. The Starting Field Located 23 vendors whose products were appliances as defined by our process

13. Our Successes In no particular order... Phoenix Adaptive Firewall SonicWALL/DMZ PIX Firewall Firebox II Interceptor

14. Phoenix Adaptive Firewall Pros: –Excellent setup process using front panel –Management via web based JAVA applet –Many logging options –Alternate command interface allows access to underlying Linux OS Cons: –Crashed twice during rule application and changes –Access control ruleset management is a bit confusing

15. SonicWALL/DMZ Pros: –Excellent management interface –Integrated DHCP server –Predefined ruleset for most common applications –Good documentation Cons: –Cheap, lightweight feel and package design, afraid we were going to break it –Logging could be more robust, and sometimes misses events –Upgrade process is firewall replacement

16. Interceptor Pros: –Easy setup and management –Includes security auditing software –Excellent reliability and resistance to Denial of Service attacks Cons: –Nmap determined underlying OS –Logging failed to notice port scans –No ability to build custom application proxies

17. PIX Firewall Pros: –Configurable and useable logs –Great documentation –Amazing failover capability –Stable and resistant to Denial of Service attacks Cons: –Setup and configuration is very complex –Initial setup is serial cable only –Requires Windows NT to administer via GUI –No application proxies

18. Firebox II Pros: –Configuration and management is easy –Robust security and Denial of Service attack resistance –Adequate logging –Visual status determination is excellent Cons: –Management is via a dedicated application –Documentation was a bit unclear

19. Some Discoveries Several products were significantly less than what we considered a firewall –Some performed only NAT with no logging or access controls –Some were only point to point encryptors Logging, in general, was poor compared to other firewall platforms

20. Other Issues Most of the devices featured management that was difficult to use or “kludgy” at best Most of the devices had no automated system to manage failure Most of the devices did not notice or log attempted attacks in any format other than rejected packet information

21. Long Term Issues Upgrade process for most products is replacement Most appliances do not offer high speed connectivity options

22. The Future of Network Appliances Better management and configuration processes More configurable logging Integrated intrusion detection software Improvements in alerting methods

23. Summary of Findings Appliance firewalls can serve as a good resource for small and medium size businesses They can provide adequate security with ease of deployment and management They possess excellent width of product options but may lack in product depth

24. Companies and Products Phoenix Firewall by Progressive Systems SonicWALL/DMZ by Sonic Systems Interceptor by Technologic, Inc. PIX Firewall by Cisco Systems Firebox II by WatchGuard Technologies Please Contact Vendors Directly for Product Information

25. Thank You! Thank you for attending today, please contact me if you have any questions or comments at bhuston@microsolved.com This presentation is copyright MicroSolved, Inc., 1999. All rights reserved. Complete results whitepaper will be available at www.microsolved.com