2. Firewall Basics Technology and Business Applications

3. Purpose Goals –IP basics –Firewall Placement –Firewall Types/Functions –Customer Needs –Business Case

4. IP communication Each machine must have a unique address Understanding the Tech

5. Each machine must also transmit and/or receive on a unique TCP or UDP port Port 1 Port 65,535 Port 1 Port 65,535 Understanding the Tech

6. Port 1 Port 65,535 Port 1 Port 65,535 In the Beginning, There were Routers with Access Control Lists (ACL) If you come from address 10.0.0.1, You may pass. Understanding the Tech

7. But ACLs did not do the job Spoofing- a packet crafted to appear to be from a trusted source Fragmentation- an IP packet is split into many pieces requiring reassembly at the destination –Offset overwrites Header replacement Payload replacement –Giant Packets –Scrambled Sequences –Fragment retransmission Understanding the Tech

8. Later on, Port source and destination filters were also added to ACLs Destination Port 21 Source Port 21 If you come from address 10.0.0.1, AND you have a source port of 21, AND you have a destination port of 21, You may pass. Understanding the Tech

9. Still not good enough... Simple Spoofing defeated, but... –Fragmentation techniques still effective Protocol impersonation “Mangled” packets Bounce attacks Hijacking Complexity exceeded benefit Understanding the Tech

10. Stateful Inspection added additional security by tracking the “state” of TCP traffic. Source Port 21 Destination Port 21 Understanding the Tech

11. Still not good enough Man in the Middle Sequence Healing Direct Connection exists Payload still not checked for protocol or syntax

12. Enter the Application Gateway (Proxy) Architecture

13. Traffic originates from 10.0.0.1. The first connection is to the Proxy’s NIC A second, unique connection is made by the Proxy device to 10.0.1.100 Proxy Firewall ALL traffic is stripped of its layer headers. Payload is analyzed at the application layer. Brand new headers are created by the Proxy and pre-pended to application traffic

14. Advantages to Proxy Spoof-proof Frag-proof Syntax checking No protocol masquerading Detailed logging

15. 3 Major Disadvantages to Proxy and 1 minor Speed –“It’s too hard!”

16. Trump Card- Adaptive Proxy Initial connection sequence is full proxy “One time” packet screening rule created to pass following traffic Connection teardown removes the One time rule –Result: “The security of Proxy with the Speed of the Packet Filter.”

17. Firewall Placement Traditional –Perimeter Internal Segmentation Gateway –Exclusive –Non-exclusive Tiered

18. Things that make Firewalls Difficult Domain Name Service (DNS) –Canonical to IP and reverse Simple Mail Transport Protocol (SMTP) Network Address Translation (NAT) –Legal –Illegal

19. Things That Make Firewalls Difficult- cont. Virtual Private Networks –Older methods intolerant of NAT –Certificates involve PKI overhead –Historically complex integration with so-called compliant products –Sparse technical competence –Multiple types Trusted Private Pass through