Abstract:-
In
today's world, most business, regardless of size, believe that access to
Internet is imperative if they are going to complete effectively. Yet
connecting a private computer (or a network) to the Internet can expose
critical or confidential data to malicious attack from anywhere in the world
since unprotected connections to the Internet (or any network topology) leaves
the user computer vulnerable to hacker attacks and other Internet threats.
Therefore, to provide high degree of protection to the network and network's
user, Firewall need to be used. Firewall provides a
barrier between the user computer and the Internet (i.e. it prevents
unauthorized Internet users from accessing private computers and networks
connected to the Internet).
Introduction to Firewalls -
Traditionally, a firewall is defined as any device used to filter or
control the flow of traffic. Firewalls are typically implemented on the network
perimeter, and function by defining trusted
and untrusted zones: Most
firewalls will permit traffic
from the trusted zone to the untrusted zone, without any explicit configuration.
However, traffic from the untrusted zone to the trusted zone must
be explicitly permitted. Thus,
any traffic that is not explicitly permitted from the untrusted to trusted zone
will be implicitly denied (by
default on most firewall systems).
A firewall is not limited to only two zones, but can contain multiple ‘less trusted’
zones, often referred to as Demilitarized
Zones (DMZ’s). To control the trust value of each zone, each
firewall interface is assigned a security level, which is often
represented as a numerical value or even color, the Trusted Zone could be
assigned a security value of 100, the Less Trusted Zone a value of 75, and the Untrusted
Zone a value of 0. As stated previously, traffic from a higher security
to lower security zone is (generally) allowed by default, while traffic
from a lower security to higher security zone requires explicit
permission.
Firewall Services
Firewalls perform the following services:
• Packet Filtering
• Stateful Packet Inspection
• Proxying
• Network Address Translation (NAT)
Each will be covered in some detail in this guide.
Packet Filtering
Packet Filtering is one of
the core services provided by firewalls. Packets
can be filtered (permitted or denied) based on a
wide range of criteria:
• Source address
• Destination address
• Protocol Type (IP, TCP, UDP, ICMP, ESP, etc.)
• Source Port
• Destination Port
Stateful Packet Inspection
Stateful packet inspection provides
services beyond simple packetfiltering, by additionally tracking TCP or
UDP sessions between devices.
For example, stateful inspection can track connections that
originate from the trusted network. This session information is kept in
a state session table,which allows temporary holes to be opened in the
firewall for the return traffic, which might otherwise be denied.
Proxy Services
A proxy server, by definition, is used to make a request on
behalf of another device. It essentially serves as a middle-man for
communication between devices. This provides an element of security, by hiding
the actual requesting source. All traffic will seem to be originated from the
proxy itself. Traditionally, proxy servers were used to cache a local
copy of requested external data. This improved performance in limited-bandwidth
environments, allowing clients to request data from the proxy, instead
of the actual external source.
Other services that proxy servers can provide:
• Logging
• Content Filtering
• Authentication
NAT
(Network Address Translation)
The
rapid growth of the Internet resulted in a shortage of IPv4 addresses. In response,
the powers that be designated a specific subset of the IPv4 address space to be
private, to temporarily alleviate this problem.
A public
address can be routed on the Internet. Thus, devices that should be Internet
accessible (such web or email servers) must be configured with public
addresses.
A private
address is only intended for use within an organization, and can never be
routed on the internet. Three private addressing ranges were allocated, one for
each IPv4 class:
•
Class A - 10.x.x.x
•
Class B - 172.16-31.x.x
•
Class C - 192.168.x.x
NAT (Network Address Translation) is used to translate between private addresses and public
addresses. NAT allows devices configured with a private address to be stamped
with a public address, thus allowing those devices to communicate across
the Internet. NAT is not restricted to just public-to-private address
translations, though this is the most common application of NAT. NAT can
perform a public-to public address translation, or a private-to-private address
translation as well. NAT provides an additional benefit – hiding the specific
addresses and
addressing structure of the internal network.
Advantages of Hardware Firewalls
·
Single Central Solution, Easier to Maintain and
Ideal for Large Organizations: A hardware
firewall allows a large organization to have a central solution for its
firewall needs. This would be better than having to install and manage firewall
software on every computer that it is connected to its network. Configuration
changes to a hardware firewall affect all the computers on that network. Thus,
those changes do not have to be carried out on each and every computer.
·
Require Little Configuration or User Input: Hardware firewalls provide strong protection
right out of the box. They do not require any configuration on the part of the
individual users. If any such configuration is needed, it is usually carried
out centrally by an experienced IT professional precluding the occurrence of
errors which may render the firewall useless.
·
Can Handle Greater Amounts of Traffic: A large network of computers generates a lot of
traffic and hardware firewalls are especially designed to manage and handle
such amounts of traffic while protecting the network at the same time.
·
Advanced and Extra Features: These include features like being able to create
and manage multiple firewalls (e.g. between different departments in an
organization), the use of more sophisticated protection methods, etc.
0 comments:
Post a Comment