SlideShare a Scribd company logo
FIREWALLS
PRESENTED BY,
R.RAMADEVI,
II – M. SC(CS&IT).
UNDERSTANDING FIREWALLS
• Firewalls come in many different shapes and size and sometime the firewall
is actually a collection of several different computer.
• All communication must pass through the firewall.The effectiveness of the
firewall is greatly reduced if an alternative network routing path
• The firewall permits only traffic that is authorized.The firewall cannot be
relied upon to differentiate between authorized and unauthorized traffic
• The firewall can withstand attacks upon itself.The firewall is relied upon to
stop attacks and nothing is deployed to protect the firewall
• Firewall strengths and weaknesses:
Firewall are singular in purpose .compromises do not need to be made
between security and usability
Firewall are excellent auditor. Plenty of disk space or remote logging
capabilities
Firewall are very good at alerting appropriate people of specified events
• Firewall weaknesses:
Firewall are only as effective as the rules they are configured to enforce
Firewall cannot stop social engineering attacks or an authorized user
intentionally using their access for malicious
packet filters
Application gateways
Circuit _ level gateways
Stateful packet _ inspection engines
Combination of above is dynamic packet filter
FIREWALLS – PACKET FILTERS
FIREWALLS – PACKET FILTERS
• Simplest of components
• Uses transport-layer information only
• IP Source Address, Destination Address
• Protocol/Next Header (TCP, UDP, ICMP, etc)
• TCP or UDP source & destination ports
• TCP Flags (SYN, ACK, FIN, RST, PSH, etc)
• ICMP message type
• Examples
• DNS uses port 53
• No incoming port 53 packets except known trusted servers
SECURITY & PERFORMANCE OF PACKET FILTERS
• IP address spoofing
• Fake source address to be trusted
• Add filters on router to block
• Tiny fragment attacks
• Split TCP header info over several tiny packets
• Either discard or reassemble before check
• Degradation depends on number of rules applied at any point
• Order rules so that most common traffic is dealt with first
• Correctness is more important than speed
PORT NUMBERING
• TCP connection
• Server port is number less than 1024
• Client port is number between 1024 and 16383
• Permanent assignment
• Ports <1024 assigned permanently
• 20,21 for FTP 23 for Telnet
• 25 for server SMTP 80 for HTTP
FIREWALLS – STATEFUL PACKET FILTERS
• Traditional packet filters do not examine higher layer context
• ie matching return packets with outgoing flow
• Stateful packet filters address this need
• They examine each IP packet in context
• Keep track of client-server sessions
• Check each packet validly belongs to one
STATEFUL FILTERING
FIREWALL OUTLINES
• Packet filtering
• Application gateways
• Circuit gateways
• Combination of above is dynamic packet filter
FIREWALL GATEWAYS
• Firewall runs set of proxy programs
• Proxies filter incoming, outgoing packets
• All incoming traffic directed to firewall
• Policy embedded in proxy programs
• Two kinds of proxies
• Application-level gateways/proxies
• Circuit-level gateways/proxies
APPLICATION-LEVEL FILTERING
• Has full access to protocol
• user requests service from proxy
Need separate proxies for each service
• E.g., SMTP (E-Mail),NNTP (Net news)
FIREWALLS - CIRCUIT LEVEL GATEWAY,
SCREENED HOST ARCHITECTURE
SCREENED SUBNET USING TWO ROUTERS
DYNAMIC PACKET FILTERS
• Most common
• Provide good administrators protection and full transparency
• Network given full control over traffic
• Captures semantics of a connection
DYNAMIC PACKET FILTERS
DUAL HOMED HOST ARCHITECTURE
ADDITIONAL FIREWALL FUNCTIONS
Firewalls are ideally situated for performing several additional function
These function include network address transation(NAT) one ip address to
another details logging of traffic and encryption necessary communication
channel(VPNs)
NETWORK ADDRESS TRANSLATION(NAT)
• Static nat
• Dynamic nat
• port address translation
• Auditind and logging
• Virtual private network
NETWORK ADDRESS TRANSLATION(NAT)
• NAT is usually implemented in a firewall separately from the policy or rule
set
• It useful to remember that just because a NAT has been defind to translate
addresses between one host and another
THANK YOU
Ad

More Related Content

What's hot (20)

firewall and its types
firewall and its typesfirewall and its types
firewall and its types
Mohammed Maajidh
 
Types of attacks
Types of attacksTypes of attacks
Types of attacks
Vivek Gandhi
 
Firewall and its types and function
Firewall and its types and functionFirewall and its types and function
Firewall and its types and function
Nisarg Amin
 
Intrusion detection system ppt
Intrusion detection system pptIntrusion detection system ppt
Intrusion detection system ppt
Sheetal Verma
 
Intrusion detection and prevention system
Intrusion detection and prevention systemIntrusion detection and prevention system
Intrusion detection and prevention system
Nikhil Raj
 
Dmz
Dmz Dmz
Dmz
أحلام انصارى
 
IP Security
IP SecurityIP Security
IP Security
Keshab Nath
 
Firewall Architecture
Firewall Architecture Firewall Architecture
Firewall Architecture
Yovan Chandel
 
Intruders
IntrudersIntruders
Intruders
Dr.Florence Dayana
 
Intrusion prevention system(ips)
Intrusion prevention system(ips)Intrusion prevention system(ips)
Intrusion prevention system(ips)
Papun Papun
 
Firewall presentation
Firewall presentationFirewall presentation
Firewall presentation
TayabaZahid
 
Firewall Design and Implementation
Firewall Design and ImplementationFirewall Design and Implementation
Firewall Design and Implementation
ajeet singh
 
Firewall
FirewallFirewall
Firewall
Nilkanth Shingala
 
Network security - OSI Security Architecture
Network security - OSI Security ArchitectureNetwork security - OSI Security Architecture
Network security - OSI Security Architecture
BharathiKrishna6
 
What is firewall
What is firewallWhat is firewall
What is firewall
Harshana Jayarathna
 
Firewall Security Definition
Firewall Security DefinitionFirewall Security Definition
Firewall Security Definition
Patten John
 
Virus and its CounterMeasures -- Pruthvi Monarch
Virus and its CounterMeasures                         -- Pruthvi Monarch Virus and its CounterMeasures                         -- Pruthvi Monarch
Virus and its CounterMeasures -- Pruthvi Monarch
Pruthvi Monarch
 
Application layer security protocol
Application layer security protocolApplication layer security protocol
Application layer security protocol
Kirti Ahirrao
 
Security Attacks.ppt
Security Attacks.pptSecurity Attacks.ppt
Security Attacks.ppt
Zaheer720515
 
Firewalls in network security
Firewalls in network securityFirewalls in network security
Firewalls in network security
Vikram Khanna
 
Firewall and its types and function
Firewall and its types and functionFirewall and its types and function
Firewall and its types and function
Nisarg Amin
 
Intrusion detection system ppt
Intrusion detection system pptIntrusion detection system ppt
Intrusion detection system ppt
Sheetal Verma
 
Intrusion detection and prevention system
Intrusion detection and prevention systemIntrusion detection and prevention system
Intrusion detection and prevention system
Nikhil Raj
 
Firewall Architecture
Firewall Architecture Firewall Architecture
Firewall Architecture
Yovan Chandel
 
Intrusion prevention system(ips)
Intrusion prevention system(ips)Intrusion prevention system(ips)
Intrusion prevention system(ips)
Papun Papun
 
Firewall presentation
Firewall presentationFirewall presentation
Firewall presentation
TayabaZahid
 
Firewall Design and Implementation
Firewall Design and ImplementationFirewall Design and Implementation
Firewall Design and Implementation
ajeet singh
 
Network security - OSI Security Architecture
Network security - OSI Security ArchitectureNetwork security - OSI Security Architecture
Network security - OSI Security Architecture
BharathiKrishna6
 
Firewall Security Definition
Firewall Security DefinitionFirewall Security Definition
Firewall Security Definition
Patten John
 
Virus and its CounterMeasures -- Pruthvi Monarch
Virus and its CounterMeasures                         -- Pruthvi Monarch Virus and its CounterMeasures                         -- Pruthvi Monarch
Virus and its CounterMeasures -- Pruthvi Monarch
Pruthvi Monarch
 
Application layer security protocol
Application layer security protocolApplication layer security protocol
Application layer security protocol
Kirti Ahirrao
 
Security Attacks.ppt
Security Attacks.pptSecurity Attacks.ppt
Security Attacks.ppt
Zaheer720515
 
Firewalls in network security
Firewalls in network securityFirewalls in network security
Firewalls in network security
Vikram Khanna
 

Similar to Firewall in Network Security (20)

firewall.ppt
firewall.pptfirewall.ppt
firewall.ppt
ssuser530a07
 
Firewall
FirewallFirewall
Firewall
YuvrajSingh428710
 
Network security
 Network security Network security
Network security
Vikas Jagtap
 
Advance firewalls
Advance firewallsAdvance firewalls
Advance firewalls
Subi Mastermind
 
Unit 5.3_Firewalls (1).ppt
Unit 5.3_Firewalls (1).pptUnit 5.3_Firewalls (1).ppt
Unit 5.3_Firewalls (1).ppt
AnuReddy68
 
Firewalls.ppt
Firewalls.pptFirewalls.ppt
Firewalls.ppt
Kaushal72
 
Firewall ( Cyber Security)
Firewall ( Cyber Security)Firewall ( Cyber Security)
Firewall ( Cyber Security)
Jainam Shah
 
Firewalls.ppt
Firewalls.pptFirewalls.ppt
Firewalls.ppt
AkhilReddy197918
 
Firewalls.ppt
Firewalls.pptFirewalls.ppt
Firewalls.ppt
Rohan389045
 
Firewalls (1).ppt
Firewalls (1).pptFirewalls (1).ppt
Firewalls (1).ppt
adnanetnzr
 
Fw.ppt
Fw.pptFw.ppt
Fw.ppt
AlbertoValencia49
 
Firewalls presentation tells about the fire walls
Firewalls presentation tells about the fire wallsFirewalls presentation tells about the fire walls
Firewalls presentation tells about the fire walls
slalithaditya1
 
Firewalls presentation powerpoint powepoint
Firewalls presentation powerpoint powepointFirewalls presentation powerpoint powepoint
Firewalls presentation powerpoint powepoint
anxiousanoja
 
Network related Firewalls security funtions
Network related Firewalls security funtionsNetwork related Firewalls security funtions
Network related Firewalls security funtions
sheharyarahmedkhan26
 
Firewalls.ppt
Firewalls.pptFirewalls.ppt
Firewalls.ppt
Sharika Technologiies
 
Firewalls.ppt
Firewalls.pptFirewalls.ppt
Firewalls.ppt
205203ANNAMALAIK
 
Cyber security tutorial2
Cyber security tutorial2Cyber security tutorial2
Cyber security tutorial2
sweta dargad
 
Section c group2_firewall_ final
Section c group2_firewall_ finalSection c group2_firewall_ final
Section c group2_firewall_ final
pg13tarun_g
 
Network defenses
Network defensesNetwork defenses
Network defenses
G Prachi
 
Seminar
SeminarSeminar
Seminar
Abhinav Kushwah
 
Ad

More from lalithambiga kamaraj (20)

Data Compression in Multimedia
Data Compression in MultimediaData Compression in Multimedia
Data Compression in Multimedia
lalithambiga kamaraj
 
Data CompressionMultimedia
Data CompressionMultimediaData CompressionMultimedia
Data CompressionMultimedia
lalithambiga kamaraj
 
Digital Audio in Multimedia
Digital Audio in MultimediaDigital Audio in Multimedia
Digital Audio in Multimedia
lalithambiga kamaraj
 
Network Security: Physical security
Network Security: Physical security Network Security: Physical security
Network Security: Physical security
lalithambiga kamaraj
 
Graphs in Data Structure
Graphs in Data StructureGraphs in Data Structure
Graphs in Data Structure
lalithambiga kamaraj
 
Package in Java
Package in JavaPackage in Java
Package in Java
lalithambiga kamaraj
 
Exception Handling in Java
Exception Handling in JavaException Handling in Java
Exception Handling in Java
lalithambiga kamaraj
 
Data structure
Data structureData structure
Data structure
lalithambiga kamaraj
 
Digital Image Processing
Digital Image ProcessingDigital Image Processing
Digital Image Processing
lalithambiga kamaraj
 
Digital Image Processing
Digital Image ProcessingDigital Image Processing
Digital Image Processing
lalithambiga kamaraj
 
Estimating Software Maintenance Costs
Estimating Software Maintenance CostsEstimating Software Maintenance Costs
Estimating Software Maintenance Costs
lalithambiga kamaraj
 
Datamining
DataminingDatamining
Datamining
lalithambiga kamaraj
 
Digital Components
Digital ComponentsDigital Components
Digital Components
lalithambiga kamaraj
 
Deadlocks in operating system
Deadlocks in operating systemDeadlocks in operating system
Deadlocks in operating system
lalithambiga kamaraj
 
Io management disk scheduling algorithm
Io management disk scheduling algorithmIo management disk scheduling algorithm
Io management disk scheduling algorithm
lalithambiga kamaraj
 
Recovery system
Recovery systemRecovery system
Recovery system
lalithambiga kamaraj
 
File management
File managementFile management
File management
lalithambiga kamaraj
 
Preprocessor
PreprocessorPreprocessor
Preprocessor
lalithambiga kamaraj
 
Inheritance
InheritanceInheritance
Inheritance
lalithambiga kamaraj
 
Managing console of I/o operations & working with files
Managing console of I/o operations & working with filesManaging console of I/o operations & working with files
Managing console of I/o operations & working with files
lalithambiga kamaraj
 
Ad

Recently uploaded (20)

What is the Philosophy of Statistics? (and how I was drawn to it)
What is the Philosophy of Statistics? (and how I was drawn to it)What is the Philosophy of Statistics? (and how I was drawn to it)
What is the Philosophy of Statistics? (and how I was drawn to it)
jemille6
 
antiquity of writing in ancient India- literary & archaeological evidence
antiquity of writing in ancient India- literary & archaeological evidenceantiquity of writing in ancient India- literary & archaeological evidence
antiquity of writing in ancient India- literary & archaeological evidence
PrachiSontakke5
 
How to Share Accounts Between Companies in Odoo 18
How to Share Accounts Between Companies in Odoo 18How to Share Accounts Between Companies in Odoo 18
How to Share Accounts Between Companies in Odoo 18
Celine George
 
History Of The Monastery Of Mor Gabriel Philoxenos Yuhanon Dolabani
History Of The Monastery Of Mor Gabriel Philoxenos Yuhanon DolabaniHistory Of The Monastery Of Mor Gabriel Philoxenos Yuhanon Dolabani
History Of The Monastery Of Mor Gabriel Philoxenos Yuhanon Dolabani
fruinkamel7m
 
U3 ANTITUBERCULAR DRUGS Pharmacology 3.pptx
U3 ANTITUBERCULAR DRUGS Pharmacology 3.pptxU3 ANTITUBERCULAR DRUGS Pharmacology 3.pptx
U3 ANTITUBERCULAR DRUGS Pharmacology 3.pptx
Mayuri Chavan
 
How to Manage Upselling in Odoo 18 Sales
How to Manage Upselling in Odoo 18 SalesHow to Manage Upselling in Odoo 18 Sales
How to Manage Upselling in Odoo 18 Sales
Celine George
 
Overview Well-Being and Creative Careers
Overview Well-Being and Creative CareersOverview Well-Being and Creative Careers
Overview Well-Being and Creative Careers
University of Amsterdam
 
TERMINOLOGIES,GRIEF PROCESS AND LOSS AMD ITS TYPES .pptx
TERMINOLOGIES,GRIEF PROCESS AND LOSS AMD ITS TYPES .pptxTERMINOLOGIES,GRIEF PROCESS AND LOSS AMD ITS TYPES .pptx
TERMINOLOGIES,GRIEF PROCESS AND LOSS AMD ITS TYPES .pptx
PoojaSen20
 
Final Evaluation.docx...........................
Final Evaluation.docx...........................Final Evaluation.docx...........................
Final Evaluation.docx...........................
l1bbyburrell
 
How to Manage Amounts in Local Currency in Odoo 18 Purchase
How to Manage Amounts in Local Currency in Odoo 18 PurchaseHow to Manage Amounts in Local Currency in Odoo 18 Purchase
How to Manage Amounts in Local Currency in Odoo 18 Purchase
Celine George
 
Cultivation Practice of Turmeric in Nepal.pptx
Cultivation Practice of Turmeric in Nepal.pptxCultivation Practice of Turmeric in Nepal.pptx
Cultivation Practice of Turmeric in Nepal.pptx
UmeshTimilsina1
 
2025 The Senior Landscape and SET plan preparations.pptx
2025 The Senior Landscape and SET plan preparations.pptx2025 The Senior Landscape and SET plan preparations.pptx
2025 The Senior Landscape and SET plan preparations.pptx
mansk2
 
MCQ PHYSIOLOGY II (DR. NASIR MUSTAFA) MCQS)
MCQ PHYSIOLOGY II (DR. NASIR MUSTAFA) MCQS)MCQ PHYSIOLOGY II (DR. NASIR MUSTAFA) MCQS)
MCQ PHYSIOLOGY II (DR. NASIR MUSTAFA) MCQS)
Dr. Nasir Mustafa
 
Redesigning Education as a Cognitive Ecosystem: Practical Insights into Emerg...
Redesigning Education as a Cognitive Ecosystem: Practical Insights into Emerg...Redesigning Education as a Cognitive Ecosystem: Practical Insights into Emerg...
Redesigning Education as a Cognitive Ecosystem: Practical Insights into Emerg...
Leonel Morgado
 
Form View Attributes in Odoo 18 - Odoo Slides
Form View Attributes in Odoo 18 - Odoo SlidesForm View Attributes in Odoo 18 - Odoo Slides
Form View Attributes in Odoo 18 - Odoo Slides
Celine George
 
All About the 990 Unlocking Its Mysteries and Its Power.pdf
All About the 990 Unlocking Its Mysteries and Its Power.pdfAll About the 990 Unlocking Its Mysteries and Its Power.pdf
All About the 990 Unlocking Its Mysteries and Its Power.pdf
TechSoup
 
LDMMIA Reiki News Ed3 Vol1 For Team and Guests
LDMMIA Reiki News Ed3 Vol1 For Team and GuestsLDMMIA Reiki News Ed3 Vol1 For Team and Guests
LDMMIA Reiki News Ed3 Vol1 For Team and Guests
LDM Mia eStudios
 
UPMVLE migration to ARAL. A step- by- step guide
UPMVLE migration to ARAL. A step- by- step guideUPMVLE migration to ARAL. A step- by- step guide
UPMVLE migration to ARAL. A step- by- step guide
abmerca
 
Myasthenia gravis (Neuromuscular disorder)
Myasthenia gravis (Neuromuscular disorder)Myasthenia gravis (Neuromuscular disorder)
Myasthenia gravis (Neuromuscular disorder)
Mohamed Rizk Khodair
 
Chemotherapy of Malignancy -Anticancer.pptx
Chemotherapy of Malignancy -Anticancer.pptxChemotherapy of Malignancy -Anticancer.pptx
Chemotherapy of Malignancy -Anticancer.pptx
Mayuri Chavan
 
What is the Philosophy of Statistics? (and how I was drawn to it)
What is the Philosophy of Statistics? (and how I was drawn to it)What is the Philosophy of Statistics? (and how I was drawn to it)
What is the Philosophy of Statistics? (and how I was drawn to it)
jemille6
 
antiquity of writing in ancient India- literary & archaeological evidence
antiquity of writing in ancient India- literary & archaeological evidenceantiquity of writing in ancient India- literary & archaeological evidence
antiquity of writing in ancient India- literary & archaeological evidence
PrachiSontakke5
 
How to Share Accounts Between Companies in Odoo 18
How to Share Accounts Between Companies in Odoo 18How to Share Accounts Between Companies in Odoo 18
How to Share Accounts Between Companies in Odoo 18
Celine George
 
History Of The Monastery Of Mor Gabriel Philoxenos Yuhanon Dolabani
History Of The Monastery Of Mor Gabriel Philoxenos Yuhanon DolabaniHistory Of The Monastery Of Mor Gabriel Philoxenos Yuhanon Dolabani
History Of The Monastery Of Mor Gabriel Philoxenos Yuhanon Dolabani
fruinkamel7m
 
U3 ANTITUBERCULAR DRUGS Pharmacology 3.pptx
U3 ANTITUBERCULAR DRUGS Pharmacology 3.pptxU3 ANTITUBERCULAR DRUGS Pharmacology 3.pptx
U3 ANTITUBERCULAR DRUGS Pharmacology 3.pptx
Mayuri Chavan
 
How to Manage Upselling in Odoo 18 Sales
How to Manage Upselling in Odoo 18 SalesHow to Manage Upselling in Odoo 18 Sales
How to Manage Upselling in Odoo 18 Sales
Celine George
 
Overview Well-Being and Creative Careers
Overview Well-Being and Creative CareersOverview Well-Being and Creative Careers
Overview Well-Being and Creative Careers
University of Amsterdam
 
TERMINOLOGIES,GRIEF PROCESS AND LOSS AMD ITS TYPES .pptx
TERMINOLOGIES,GRIEF PROCESS AND LOSS AMD ITS TYPES .pptxTERMINOLOGIES,GRIEF PROCESS AND LOSS AMD ITS TYPES .pptx
TERMINOLOGIES,GRIEF PROCESS AND LOSS AMD ITS TYPES .pptx
PoojaSen20
 
Final Evaluation.docx...........................
Final Evaluation.docx...........................Final Evaluation.docx...........................
Final Evaluation.docx...........................
l1bbyburrell
 
How to Manage Amounts in Local Currency in Odoo 18 Purchase
How to Manage Amounts in Local Currency in Odoo 18 PurchaseHow to Manage Amounts in Local Currency in Odoo 18 Purchase
How to Manage Amounts in Local Currency in Odoo 18 Purchase
Celine George
 
Cultivation Practice of Turmeric in Nepal.pptx
Cultivation Practice of Turmeric in Nepal.pptxCultivation Practice of Turmeric in Nepal.pptx
Cultivation Practice of Turmeric in Nepal.pptx
UmeshTimilsina1
 
2025 The Senior Landscape and SET plan preparations.pptx
2025 The Senior Landscape and SET plan preparations.pptx2025 The Senior Landscape and SET plan preparations.pptx
2025 The Senior Landscape and SET plan preparations.pptx
mansk2
 
MCQ PHYSIOLOGY II (DR. NASIR MUSTAFA) MCQS)
MCQ PHYSIOLOGY II (DR. NASIR MUSTAFA) MCQS)MCQ PHYSIOLOGY II (DR. NASIR MUSTAFA) MCQS)
MCQ PHYSIOLOGY II (DR. NASIR MUSTAFA) MCQS)
Dr. Nasir Mustafa
 
Redesigning Education as a Cognitive Ecosystem: Practical Insights into Emerg...
Redesigning Education as a Cognitive Ecosystem: Practical Insights into Emerg...Redesigning Education as a Cognitive Ecosystem: Practical Insights into Emerg...
Redesigning Education as a Cognitive Ecosystem: Practical Insights into Emerg...
Leonel Morgado
 
Form View Attributes in Odoo 18 - Odoo Slides
Form View Attributes in Odoo 18 - Odoo SlidesForm View Attributes in Odoo 18 - Odoo Slides
Form View Attributes in Odoo 18 - Odoo Slides
Celine George
 
All About the 990 Unlocking Its Mysteries and Its Power.pdf
All About the 990 Unlocking Its Mysteries and Its Power.pdfAll About the 990 Unlocking Its Mysteries and Its Power.pdf
All About the 990 Unlocking Its Mysteries and Its Power.pdf
TechSoup
 
LDMMIA Reiki News Ed3 Vol1 For Team and Guests
LDMMIA Reiki News Ed3 Vol1 For Team and GuestsLDMMIA Reiki News Ed3 Vol1 For Team and Guests
LDMMIA Reiki News Ed3 Vol1 For Team and Guests
LDM Mia eStudios
 
UPMVLE migration to ARAL. A step- by- step guide
UPMVLE migration to ARAL. A step- by- step guideUPMVLE migration to ARAL. A step- by- step guide
UPMVLE migration to ARAL. A step- by- step guide
abmerca
 
Myasthenia gravis (Neuromuscular disorder)
Myasthenia gravis (Neuromuscular disorder)Myasthenia gravis (Neuromuscular disorder)
Myasthenia gravis (Neuromuscular disorder)
Mohamed Rizk Khodair
 
Chemotherapy of Malignancy -Anticancer.pptx
Chemotherapy of Malignancy -Anticancer.pptxChemotherapy of Malignancy -Anticancer.pptx
Chemotherapy of Malignancy -Anticancer.pptx
Mayuri Chavan
 

Firewall in Network Security

  • 2. UNDERSTANDING FIREWALLS • Firewalls come in many different shapes and size and sometime the firewall is actually a collection of several different computer. • All communication must pass through the firewall.The effectiveness of the firewall is greatly reduced if an alternative network routing path • The firewall permits only traffic that is authorized.The firewall cannot be relied upon to differentiate between authorized and unauthorized traffic
  • 3. • The firewall can withstand attacks upon itself.The firewall is relied upon to stop attacks and nothing is deployed to protect the firewall • Firewall strengths and weaknesses: Firewall are singular in purpose .compromises do not need to be made between security and usability Firewall are excellent auditor. Plenty of disk space or remote logging capabilities Firewall are very good at alerting appropriate people of specified events
  • 4. • Firewall weaknesses: Firewall are only as effective as the rules they are configured to enforce Firewall cannot stop social engineering attacks or an authorized user intentionally using their access for malicious packet filters Application gateways Circuit _ level gateways Stateful packet _ inspection engines Combination of above is dynamic packet filter
  • 6. FIREWALLS – PACKET FILTERS • Simplest of components • Uses transport-layer information only • IP Source Address, Destination Address • Protocol/Next Header (TCP, UDP, ICMP, etc) • TCP or UDP source & destination ports • TCP Flags (SYN, ACK, FIN, RST, PSH, etc) • ICMP message type • Examples • DNS uses port 53 • No incoming port 53 packets except known trusted servers
  • 7. SECURITY & PERFORMANCE OF PACKET FILTERS • IP address spoofing • Fake source address to be trusted • Add filters on router to block • Tiny fragment attacks • Split TCP header info over several tiny packets • Either discard or reassemble before check • Degradation depends on number of rules applied at any point • Order rules so that most common traffic is dealt with first • Correctness is more important than speed
  • 8. PORT NUMBERING • TCP connection • Server port is number less than 1024 • Client port is number between 1024 and 16383 • Permanent assignment • Ports <1024 assigned permanently • 20,21 for FTP 23 for Telnet • 25 for server SMTP 80 for HTTP
  • 9. FIREWALLS – STATEFUL PACKET FILTERS • Traditional packet filters do not examine higher layer context • ie matching return packets with outgoing flow • Stateful packet filters address this need • They examine each IP packet in context • Keep track of client-server sessions • Check each packet validly belongs to one
  • 11. FIREWALL OUTLINES • Packet filtering • Application gateways • Circuit gateways • Combination of above is dynamic packet filter
  • 12. FIREWALL GATEWAYS • Firewall runs set of proxy programs • Proxies filter incoming, outgoing packets • All incoming traffic directed to firewall • Policy embedded in proxy programs • Two kinds of proxies • Application-level gateways/proxies • Circuit-level gateways/proxies
  • 13. APPLICATION-LEVEL FILTERING • Has full access to protocol • user requests service from proxy Need separate proxies for each service • E.g., SMTP (E-Mail),NNTP (Net news)
  • 14. FIREWALLS - CIRCUIT LEVEL GATEWAY, SCREENED HOST ARCHITECTURE
  • 15. SCREENED SUBNET USING TWO ROUTERS
  • 16. DYNAMIC PACKET FILTERS • Most common • Provide good administrators protection and full transparency • Network given full control over traffic • Captures semantics of a connection
  • 18. DUAL HOMED HOST ARCHITECTURE
  • 19. ADDITIONAL FIREWALL FUNCTIONS Firewalls are ideally situated for performing several additional function These function include network address transation(NAT) one ip address to another details logging of traffic and encryption necessary communication channel(VPNs)
  • 20. NETWORK ADDRESS TRANSLATION(NAT) • Static nat • Dynamic nat • port address translation • Auditind and logging • Virtual private network
  • 21. NETWORK ADDRESS TRANSLATION(NAT) • NAT is usually implemented in a firewall separately from the policy or rule set • It useful to remember that just because a NAT has been defind to translate addresses between one host and another
  翻译: