Firewall Fundamentals

The Difference Between Policies Standards Guidelines and Procedures

One of the more confusing elements of security policies is the interaction between policies, standards, guidelines, and procedures. First, let's define what we mean by each Policy A policy is a document that outlines the requirements or rules that must be met. Policies frequently refer to standards or guidelines as the basis for the existence. The scope of a policy tends to be a broad, high level statement of intent.

Bad IP Packets

In most cases, the IP packets that are received on a network can be successfully processed and acted upon accordingly. As is true with all network communications, however, it is possible for an IP packet to either be accidentally or intentionally designed in such a way as to be a bad packet. When we say bad packet, we mean a packet that for whatever reason cannot be processed properly. In some cases, this may be the result of unreliable delivery of the data (for example, if a portion of the...

High Availability Firewall Designs

Because firewalls have become critical infrastructure components on the network, it is important to ensure that the firewall, and the functionality that it provides, is always available and accessible. Firewall high availability (HA) and redundancy is typically handled in one of two ways Regardless of the failover method, firewall HA relies on implementing two firewalls in a parallel configuration. With an active passive system, one firewall is actively passing traffic while the other firewall...

Network Firewalls

Network firewalls are designed to protect whole networks from attack. Network firewalls come in two primary forms a dedicated appliance or a firewall software suite installed on top of a host operating system. Examples of appliance-based network firewalls include the Cisco PIX, the Cisco ASA, Juniper's NetScreen firewalls, Nokia firewalls, and Symantec's Enterprise Firewall. The more popular software-based firewalls include Check Point's Firewall-1 NG or NGX Firewalls, Microsoft ISA Server,...

The OSI Model

The OSI model is a layered model that has been standardized for defining network communications. The OSI model breaks the complex process of network communications into seven distinct layers, each with it own distinct responsibilities. As shown in Figure 3-1, the seven layers of the OSI model are as follows The application layer (Layer 7) Primarily responsible for interfacing with the end user The presentation layer (Layer 6) Primarily responsible for translating the data from something the...

Microsoft ISA Server 2004 Features

Microsoft ISA Server 2004 consists of two editions Standard Edition and Enterprise Edition. The predominant differences between the Standard and Enterprise editions relate to scalability. Table 8-summarizes the differences between the Standard and Enterprise editions. Table 8-1. Comparison of ISA Server 2004 Standard and Enterprise Editio Table 8-1. Comparison of ISA Server 2004 Standard and Enterprise Editio Unlimited, with the additio of enterprise networks (networks that can be app to any...

Configuring NAT Settings for Outbound Access

After the default route has been set, the PIX ASA is almost ready to pass traffic between the inside, higher-security interface and the outside, lower-security interface. In most situations, to provide for this outbound traffic functionality you need to configure NAT because the firewall will typically be hiding the internal network IP addresses from the external network resources using NAT. This is not a requirement, however (although it is generally recommended), and the PIX ASA 7.0 in...

Single Firewall System

With a single-firewall architecture, the firewall system consists of the following layers Network segment between the external router and firewall Figure 9-4 depicts this architecture. At the outermost layer of the firewall system, the external router should be the first point of control of traffic entering (ingress filtering) and exiting (egress filtering) your network. The only traffic that should be allowed to traverse the router is traffic destined for the firewall or resources being...

What to Look for in Firewall Logs

After you have collected the firewall logs and begun the process of analyzing the logs, determine the you should be looking for in the logs. With that said, it is important to remember not to fall into the looking in your firewall logs only for bad events. Yes, firewall logs can be the key element in discov incidents and compromises, but that is only one of the reasons for analyzing your logs. You also war to use the log information to assist in defining the baselines and normal operations of...

Telnet vs SSH

Telnet is an unencrypted network communication protocol that is typically used to provide remote access to systems and other devices. Telnet is originally defined in RFC 854 and was developed long before the Internet was in its current formwhen networks were much smaller. Not much consideration was given in the Telnet protocol design to confidentiality in the data being transmitted using the protocol. Therefore, all data transmitted using the Telnet protocol is subject to eavesdropping and...

Figure 121 Delivery of Syslog Messages Across the Network

The syslog client is then configured to deliver syslog messages to the syslog server. For example, you can configure a Cisco Secure PIX Firewall to use syslog by running the following basic commands. For Cisco Secure PIX Firewalls running versions of the PIX OS other than 7.0, the commands are as follows logging trap information logging host inside ip-address For Cisco Secure PIX Firewalls running version 7.0 or later, you need to run the following commands from the configuration mode In...

Proxy Firewalls

A proxy firewall acts as an intermediary between two end systems in a similar fashion as a circuit-level gateway. However, in the case of a proxy firewall, the interaction is controlled at the application layer, as shown in Figure 2-6. Proxy firewalls operate at the application layer of the connection by forcing both sides of the conversation to conduct the communication through the proxy. It does this by creating and running a process on the firewall that mirrors a service as though it were...

Limitations of Application Proxy Firewalls

Because of how effective application proxies can be at filtering traffic, one might wonder why everyone does not use an application proxy firewall. There are a few good reasons for this. First, application proxies are only effective at proxying requests for applications that the proxy has defined. Unfortunately, most proxies can handle only a relatively small number of applications. This limitation means that the other applications are not permitted, or that you have to use a generic service...

Open and Closed Source Firewalls

You can find a wide variety of firewalls available on the market today. Some are open source, such as Linux's IPTables, OpenBSD's pf, and the Solaris IPF firewalls. Others are closed source, such as the Cisco PIX and ASA firewall operating systems, Juniper's ScreenOS, and Check Point's firewall software. Some even use an underlying open source operating system and firewall code with closed source modifications. The differences between these firewalls are most typically noticeable in the...

Cisco PIX Firewall and ASA Security Appliance

One of the most widely deployed firewalls on the Internet is the Cisco PIX Firewall. The PIX, along with the new Cisco Adaptive Security Appliance (ASA), is poised to improve Cisco's market share of the firewall and virtual private network (VPN) marketplace by providing advanced security, increased performance, and more robust functionality. Originally acquired from a company called Network Translations back in the early to mid-1990s, the PIX has undergone significant development and...

Configuring the Firewall for Remote Management Access

The PIX ASA firewall supports three primary methods of remote management access Both Telnet and SSH are used to provide CLI access to the firewall, whereas the ASDM PDM provides an HTTPS-based GUI management console. Telnet remote management is the simplest, yet least secure, method of remotely managing the firewall. The reason for this is that Telnet does not encrypt the data in transmit and in fact sends the data in cleartext. This makes it easy for a malicious user to capture the data and...

Configuring the ACLs

Controlling traffic is the cornerstone of all firewalls, and the PIX ASA controls the flow of traffic through the firewall by implementing ACLs. PIX ASA ACLs are essentially linked lists of values known as ACL entries (ACEs) that are parsed in a top-down manner with entries at the top of the ACL being processed before entrees further down the ACL are processed. This processing is performed in a first-match manner, which means that as soon as the data being processed by an ACL is matched to an...

Packet Filters

Packet filters are network devices that filter traffic based on simple packet characteristics. These devices are typically stateless in that they do not keep a table of the connection state of the various traffic flows through them. To allow traffic in both directions, they must be configured to permit return traffic. Simple packet filters include Cisco IOS access lists as well as Linux's ipfwadm facility to name a few. Although these filters provide protection against a wide variety of...

Figure 56 Filter Screen

If you want to filter by MAC address, just click the Edit MAC Filter Setting button and specify the MAC addresses that should be denied access. At the bottom of the screen are four radial selections with the default setting in parenthesis Block Anonymous Internet Requests (Enabled) This setting prevents the router from being able to be pinged or otherwise connected to on the external interface, unless you have defined a port-forwarding filter. This should be enabled, but keep in mind that not...

Cisco Secure PIX Firewall Syslog Event Baseline

The following syslog events constitute a good baseline of events that should be monitored and paid attention to in most environments. In essence, this list is here to answer this question What specifi events should I look for It is not meant to be an exhaustive list of all syslog message IDs or the on message IDs that you should be filtering for. You can use this information to help build filtering rules for your particular logging softwarefor exam identify the messages that administrators...

Overview of IDS

Intrusion detection is an aspect of security whereby a device detects the fingerprint of an attack within the network. Modern IDSs use a variety of techniques to ensure that the alarms they raise are of actual attacks being conducted rather than a false alarm. Many IDSs connect to the network through a port on a switch, and the interface that connects to that port captures traffic to a particular system or subnet, as shown in Figure 14-2. As firewall hardware has become more and more powerful,...

How the Trend Micro Firewall Works

The Trend Micro firewall works as a blend of a traditional stateful firewall and intrusion detection system (IDS). An IDS monitors the traffic in and out of the protected system for attacks and upon detection of an attack it can alert the user. Most IDSs detect attacks by matching the network traffic against a signature of the attack. A signature is like a fingerprint. It identifies an attack by matching the network traffic (the evidence) against a known signature describing the attack (the...

Figure 412 Trend Micro Firewall Profiles

The default profiles include an office network connection, a home network connection, a wireless network connection, and a direct connection to the Internet. Each one has specific exceptions to the firewall policy for various services. The office network, wireless network, and direction connection profiles each have a list of specific exceptions for various services such as HTTP, Secure Shell (SSH), DNS, and others in the firewall profile. The home network profile, however, has no preconfigured...

Trend Micro Firewall Checklist

Like the Windows Firewall, you must configure several features depending on the system role in the network. One of the key differences is that the Windows Firewall should be disabled. Fortunately, the Trend Micro Internet security suite installer checks the status of the Windows Firewall before installing the Trend Micro product to ensure that no conflict exists between the two firewalls. You can use the following checklist to help ensure that the Trend Micro firewall settings are appropriate...

Targeted Versus Untargeted Attacks

On the surface, the difference between a targeted and untargeted attack may seem pretty unimportant. As the saying goes, an attack is an attack, regardless of source. While in the midst of an attack, whether the attack is targeted or not may fall down the list of priorities. However, it is important to define the difference because it could impact the ultimate level of response required to address the attack. Untargeted attacks are attacks that are not directly motivated by the resources being...

Figure 136 Verifying Firewall Functioning

Type ticlp nt 1 tor a list fl EIVTIIIV LD 70H> plJeci Oli TlLU O -Jtug-0 5 E ftS FLasll W129F-J00S 0 OliiritfSQDO, JZKE ISiisiiiiujl- Pbyjlc I& CcEjiac (.'gntismut gn ti > s not ficen incdiiii-d sua If the firewall is up and running, the next step is to test the Internet connection on the outside interface of the firewall. You can do this by pinging a system out on the Internet. Doing so is somewhat tricky because many networks filter out unsolicited ICMP requests. However, some of the...

The Syslog Protocol

The syslog protocol is the de facto standard method of providing event notification messages across the network. Syslog is defined by RFC 3164 and uses UDP as the default transport mechanism (by default and typically over UDP port 514). By using UDP, syslog gains the advantage of being a low-overhead connectionless delivery method (thus requiring less resources on the systems doing the logging), but that also results in syslog being an inherently unreliable delivery method. Although not common,...

Port Scanning Tools

Port-scanning tools function by attempting to connect to a host using a range of TCP and UDP ports. This information can then be used to determine which ports are listening, and thus which applications are probably running on the host. Portscanning tools are one of the best ways to test your firewall ruleset, because the ruleset should allow traffic only on the ports that you have defined. If you port scan the firewall (or the IP addresses of the protected hosts the firewall is protecting) and...

NAT Firewalls

A distinct firewall that existed for a short period is the Network Address Translation (NAT) firewall. In today's firewall market, NAT is a part of almost every firewall product available. From the lowliest SOHO firewall such as the Linksys BEFSX41 to the high-end enterprise PIX 535, NAT is now a function of a firewall. NAT firewalls automatically provide protection to systems behind the firewall because they only allow connections that originate from the inside of the firewall. The basic...

Stateful Inspection

Stateful packet inspection lies at the heart of how PIX ASA firewalls function. This functionality is provided through a process known as the Cisco adaptive security algorithm (ASA). The ASA uses a stateful approach to security. Every inbound packet is checked exhaustively against the ASA and against connection state information in memory. The ASA applies the following default rules (although this is by far not an exhaustive list) to traffic coming into the PIX Allow any traffic connections...

Configuring Logging on the Firewall

One of the most valuable capabilities of any firewall is the ability to log events so that the administrator can be informed of and aware of what is going on with the firewall. Cisco PIX ASA firewalls use syslog for the logging of all events on the firewall (syslog and logging in general is discussed in much greater detail in Chapter 12, What Is My Firewall Telling Me ), which allows an administrator to be able to read parse the logs for important events or events that may require additional...

Default Passwords

When you purchase a new firewall (or any network device in general) such as a Cisco PIX, a Linksys, a NetScreen, or a SonicWall, out of the box the device has some default passwords set (and in some cases there is no default password). This is because the manufacturer must allow for initial access to the device for the end user to configure it. Most recent documentation for any device admonishes the end user to immediately change the default password to something else. Table 11-1 shows common...

Transparent Firewalls

Transparent firewalls (also known as bridging firewalls) are not a completely new firewall but rather a subset of stateful firewalls. Whereas nearly all firewalls operate at the IP layer and above, transparent firewalls sit at Layer 2, the data link layer, and monitor Layer 3+ traffic. Additionally, the transparent firewall can apply packet-filtering rules like any other stateful firewall and still appear invisible to the end user. In essence, the transparent firewall acts as a filtering bridge...

How Application Filtering Works

Application filtering typically functions through the use of processes known as application proxies, application gateways, service proxies, application filters (Microsoft ISA Server 2004 term), or fixups (Cisco term). These application filters typically provide stateful application layer filtering of the data that is traversing the firewall. Generally, the application filters perform two functions Protocol access Protocol access provides a means of permitting secondary connections for protocols...

Packet Analysis Tools

As mentioned in Chapter 3, TCP IP for Firewalls, TCP IP is the language that most network-connected hosts use to communicate with each other. Packet-analysis tools enable you to view the raw transmitted data, providing an incredibly valuable troubleshooting technique. Through the use of tools such as Ethereal, Microsoft Network Monitor, and TCPDump, you can observe all aspects of network communications between hosts, allowing you to detect and identify network-based problems and communications...

How This Book Is Organized

This book provides a building-block approach to the material. The initial focus is on the basics of firewalls and a review of TCP IP. Although the book is intended to be read cover to cover, it can also provide point references for various products and concepts. Chapters 1 through 3 provide the necessary background to firewalls and TCP IP concepts as they relate to firewalls. The core content lies in Part II and Part III, where the focus shifts to how various firewall products are implemented...

How Broadband Routers and Firewalls Work

Many broadband routers and firewalls function primarily through the use of Network Address Translation (NAT) to hide the internal systems behind a single external IP address. These so-called NAT routers or NAT firewalls do an adequate job of hiding resources from casual attack methods, but they do not perform advanced firewall functions therefore, it is really a bit of a misnomer to call them firewalls, at least in the sense that firewalls such as the Cisco Secure PIX Firewall, Microsoft ISA...

Microsoft ISA Server 2004 Requirements and Preparation

ISA Server 2004 can be a relatively complex product to implement. A number of system requiremer and recommendations should be implemented before installing and configuring ISA Server 2004. Ta 8-2 details the system requirements as well as my recommendations beyond the system requiremet Mirrored or RAID5 36-GB capacity v separate disks for caching (if implemented) At least two 10 100-Mbps network adapters At least two 100 1000-Mbps networ adapters Microsoft Windows 2000 Server or Advanced Server...

The IP Packet Header

The IP packet header is what tells an IP-based host what to do with the packet that was received. Think of it as an instruction manual that contains the how to process this packet information. Therefore, an attacker wanting to generate malicious traffic will frequently modify the IP packet header in such a way as to instruct the receiving host to do something harmful with the packet, or to instruct the host to do something it is not capable of doing in hopes that it causes the host to generate...

Ingress Filters

Ingress filters are used to restrict traffic coming into an interface or from a given network segment. Ingress filters are commonly applied to traffic coming from an untrusted source (such as the Internet or a DMZ segment) to a trusted source (such as a DMZ or internal network, respectively). To really get comfortable with the concept of ingress filters, it is important to understand that a filter is an ingress filter relative to the direction and source of the traffic being filtered. For...

Developing a Troubleshooting Checklist

There is an old saying that when you practice what you need to do in the time of a crisis, when the crisis occurs the reaction tends to be automatic. When the firewall is down is not the time to try to figure out what you should be looking at to resolve the problem. Instead, develop a troubleshooting checklist in advance. The reason is simple There will already be enough stress and confusion as a result of the failure there is no need to increase either by not having a plan. Your...

ICMP Message Structure

ICMP controls the data being transmitted over the network through the use of numerous message types. Each ICMP message type contains specific formatting related to its function, but most implement a header and data field of varying lengths. All ICMP messages begin with the same 32 bits of data. First, 8 bits of data known as the TYPE field define the ICMP type. Next, 8 bits of data known as the CODE field provide additional information specific to the message type. Then, 16 bits of data known...

Firewall Taxonomy

Firewalls come in various sizes and flavors. The most typical idea of a firewall is a dedicated system or appliance that sits in the network and segments an internal network from the external Internet. Most home or SOHO networks use an appliance-based device for broadband connectivity that includes a built-in firewall. In general, firewalls can be categorized under one of two general types Desktop or personal firewalls The primary difference between these two types of firewalls simply boils...

Figure 312 Address Classes

Classless Interdomain Routing (CIDR) Although the classful address space is a great idea, the truth is that not everyone needs networks with the number of hosts that each class of address provides. For example, if you have more than 255 hosts that you need to connect to a network, using the classful address space you have to bump up to a full Class B, providing for 65,534 hosts on the network. Obviously, that is far more hosts than is necessary. To address this deficiency, CIDR was implemented....

The Department of Defense DoD Model

Although OSI is a protocol independent framework for defining communications, and thus is portable and applicable to almost all network communications, it does not always map directly to a particular communications process. For example, just because the OSI model defines seven distinct layers does not mean that there must be seven distinct communications processes or protocols in use. In many cases, a protocol may implement functions that span multiple layers (for example, TCP which has some...

Firewalls Record and Report on Events

The simple reality is that regardless of what you do to protect resources with a firewall, you cannot stop every malicious act or all malicious data. From simple misconfigurations of the firewall to new threats and exploits the firewall cannot protect against yet, you have to be prepared to deal with a security event that the firewall was not able to prevent. As a result, all firewalls should have a method of recording all communications (in particular access policy violations) that occur to...

Firewalls and VLANs

One of the most common questions with regard to designing a firewall implementation is how VLANs other. Historically, firewalls and VLANs went together like oil and water. Physical separation of resou was a sacred cow. It was an untouchable fact in network security. This was reinforced by exploits ar traffic to traverse between VLANs without going through a firewall or router, effectively bypassing ai few things have contributed to a change in thinking regarding firewalls and VLANs. First,...

How Net Filter Works

NetFilter, or more commonly known by the name of the manipulation utility, iptables, works, on the surface, similarly to the ipchains firewall code of earlier Linux kernels. The first thing you need to understand about NetFilter is the concept of tables, chains, and rules. Tables are used to provide certain types of functionality, which are defined in more detail through this chapter. Chains define the path in which a packet can travel. The chains are made up of rules, which define what action...

Firewall Security Policy

The firewall security policy (not to be confused with the general security policies discussed in Chapter 10, Firewall Security Policies) on the PIX firewall is what determines the traffic that will be permitted or denied by the firewall. To facilitate this, the PIX implements a combination of the following elements to assist in making filtering decisions Separate the network into zones based on security levels Use ACLs to permit or deny traffic Apply Network Address Translation (NAT) Apply...

Firestarter

Firestarter is an open source visual firewall policy compiler similar to Firewall Builder. Like Firewall Builder, Firestarter provides the administrator with a graphic interface to build a filtering policy. However, unlike Firewall Builder, Firestarter cannot group items into objects or provide control over multiple firewalls. Firestarter is focused on the policy of a single firewall. Firewall Builder, on the other hand, can manage the policies of multiple firewalls from a central server....

Firewall Modes of Operation

Traditionally, PIX firewalls operated in a single mode of operation, known as routed mode. This is the most common firewall mode of implementation and treats the firewall as a router hop on the network. Devices on one side of the firewall are considered to be on different subnets than devices on the other side With the advent of PIX ASA 7.x and the ASA security devices, a new mode of operation known as transparent mode was implemented. In transparent mode, the firewall operates more like a...

Example A10 Basic Nmap SYN Port Scan Against a Cisco Secure PIX Firewall

root keoland nmap nmap -sS -P0 -O -vv 10.10.10.1 Starting nmap 3.93 ( http www.insecure.org nmap ) at 2005-10-04 14 10 CDT Initiating ARP Ping Scan against 10.10.10.1 1 port at 14 10 The ARP Ping Scan took 0.01s to scan 1 total hosts. Initiating SYN Stealth Scan against firewall.myco.com (10.10.10.1) 1668 ports at 14 10 Discovered open port 443 tcp on 10.10.10.1 Discovered open port 25 tcp on 10.10.10.1 Discovered open port 21 tcp on 10.10.10.1 Discovered open port 80 tcp on 10.10.10.1 SYN...

Choosing Between the PIX and the ASA

One of the first questions to answer when trying to determine what Cisco firewall your environment requires is what the difference between the Cisco PIX Firewall and the Cisco ASA is. The ASA is essentially the latest version of the Cisco firewall solution and is based largely on the PIX software. In fact, the Cisco ASA and enterprise versions of the PIX (PIX 515E and larger) actually run the same firewall software starting with the 7.x code base. In the case of the PIX, this firewall software...

Different Classes of Routing Protocols

Although each routing protocol has its own specific functionality, they can all be generally classified as falling into three categories Distance vector Distance vector routing protocols are relatively simplistic in design and tend to use a distance to determine the best path. The distance is measured by counting how many times a packet goes through a router, known as a hop, until it arrives at the destination network. The smaller the hop count, the shorter and better the route. Distance vector...

Applications That Are Hard to Firewall

The difficulty with application firewalls stems from the fact that the transaction between the client an server is complex and can be made more so if the protocol or the data in the communication expand increases the complexity of the transaction. Protocols such as eXtensible Markup Language (XML) ar Simple Object Access Protocol (SOAP) make web application firewalls especially tricky. To provide pi web application security, the application firewall must have a detailed understanding of...

Linux Based Firewalls

Linuxbased firewalls come in a variety of flavors. Originally, Linux-based firewalls were based on the ipfw code (which itself was taken from the Berkeley Software Distribution BSD of UNIX). This code comprised the original version of firewall capabilities within the Linux kernel. The next evolutionary step beyond ipfw was the ipfwadm utility (which was actually a rewrite of BSD's ipfw utility). This firewall code and utility began to be available in Linux kernels in the 1.0 series and provided...

Determining If You Need a Firewall

It is convenient (and accurate) to say that you always need a firewall if you are connecting to the Internet. Firewalls should not be relegated exclusively to the realm of providing access to and protection from Internet-based resources. Instead, you should consider implementing a firewall any time a resource needs to be protected, regardless of where the protected resource is located, or where the requesting traffic will be coming from. Firewalls can, and in many cases should, be used to...

Firewall Builder

You can find the Firewall Builder software at http www.fwbuilder.org. Unlike other firewall management software, Firewall Builder provides a policy compiler for Linux's NetFilter firewall as well as for FreeBSD's and OpenBSD's packet filter (pf) firewall, the IPFilter (IPF) firewall, and the Cisco PIX Firewall. IPF is another open source firewall software package that can be built in to a variety of operating systems, including Sun Solaris, NetBSD, FreeBSD, OpenBSD, HP's HPUX, and SGI's IRIX...

Updating the Firewall Software

The final topic to consider when managing firewalls is updating the firewall software. There are two update the software. One reason is to take advantage of new capabilities added to newer software v reason is the need to fix bugs and vulnerabilities in the software. Like all software, firewall software contains many lines of code. The code in the firewall may have been rigorously tested, but there wil that the software developers did not consider or just outright overlooked. A corner case is a...

Firewall Specific Information

NIST Guidelines on Firewalls and Firewall Policy, Firewall Software and Internet Security FAQ, white paper.html General Firewall Configuration Guide, Personal Firewalls for Remote Access Users, Windows ICF, Linksys Firewalls, http www.linksys.com Cisco PIX Firewalls, http www.cisco.com go pix Cisco ASA, http www.cisco.com go asa Yahoo Groups PIX Firewall, http groups.yahoo.com group PIX Firewall Linux NetFilter, http www.netfilter.org Linux IPChains, Firestarter, http www.fs-security.com...

Windows Firewall and Windows XP

The ICF, now dubbed Windows Firewall, is a simple stateful firewall that is part of the Windows XP operating system. In essence, Windows firewall provides the same core functionality that other personal firewall products on the market provide, such as stateful connection management and configurability for specific traffic that is desired. Windows Firewall does come bundled with every new version of Microsoft's operating systems. The firewall capabilities can also be utilized in Windows Server...

Examples of Security Policies

You have two primary security policies to use as a baseline in designing your security policy. The first is the closed security policy, also known as the minimalist security policy. The other is an open security policy, also known as generally a bad idea. The closed security policy is based on the premise that by default all access is denied, and only access that is explicitly required will be permitted. The benefit of this approach is that the security policy will be designed only to allow...

Linksys Checklist

To implement a basic Linksys router, perform the following tasks Step 1. Obtain the connection information required by your ISP. Step 2. Plug the router into the service provider device or network jack using the external WAN interface of the router. Connect a computer that is configured to be a DHCP client to one of the switch ports on the router. Step 5. Turn the computer on. The computer should automatically obtain an IP address from the router, allowing it to connect to the router. Step 6....

TCP Segment Header

Like IP, the TCP segment header typically consists of five 32-bit words, with the potential for optional words containing additional options and the relevant padding to make 32 bits of data. Figure 3-9 depicts the TCP segment header. Figure 3-9. TCP Segment Header Structure The fields of the TCP segment header and their meanings are as follows Source Port (16 bits) This field represents the source protocol or application. This allows the source to know which application the data belongs to so...

Network Address Translation NAT

NAT was developed to address a couple of concerns. First, the number of public IP addresses available on the Internet was becoming depleted. Second, because of the interconnectivity of networks, it was possible for an administrator to assign a set of IP addresses to a network that someone else might be using. This is a common situation when two companies and their respective networks are combined. NAT addresses these two concerns by providing a mechanism by which any number of IP addresses can...

How Firewalls Use Protocols Applications and Services

Now that you understand what protocols, applications, and services are, how do firewalls use them Because the primary objective of a firewall is to protect a host or network from access, and protocols, applications, and services define how hosts are accessed from the network, firewalls can use the information from protocols, applications, and services to make filtering decisions and grant or deny access. For example, if you want to allow web access to a system, technically what you are doing is...

Why Logging Is Important

It is easy to say that you should log events from your firewalls because doing so provides insight as to the status of your firewall, but there are a number of specific and tangible benefits to logging Improves network administration, troubleshooting, and debugging Helps to determine the health of the system Provides intrusion detection and incident containment Facilitates performing forensic analysis Improved Network Administration, Troubleshooting, and Debugging If there is one certainty in...

How the IP Routing Process Works

For all the apparent complexity involved in routing, the routing process itself is a pretty simple and straightforward process. In fact, when you understand the routing process fundamentals, it does not matter how large or small the network is the process is the exact same. To illustrate the routing process, look at Figure 3-15. This example shows two hosts, Host A and Host B, on two separate networks. Host A has an IP address of 10.1.1.100 and a MAC address of 00 05 9A 3C 78 50. Host B has an...

Figure 310 UDP Header Structure

31 31 The UDP header contains two 32-bit words with the following fields and meanings Source Port (16 bits) This field represents the source protocol or application. This allows the source to know which application the data belongs to so that responses can be delivered to the appropriate source application. In most cases, the source port is a random high-level port number (> 1024) generated by the application. Destination Port (16 bits) This field represents the destination protocol or...

Vulnerability Scanning Tools

Vulnerability scanning takes the concept of port scanning to the next level. Now that you know which ports are open, which vulnerabilities might exist on the host that is listening on those ports You can use a number of commercial and freeware vulnerability scanners to test virtually any system on a network, including firewalls. One of the most popular is the open source vulnerability scanner named Nessus. You can obtain Nessus from http www.nessus.org it is freeware and can be installed on...

Logging and Log Analysis Tools

Most firewalls can log events related to traffic that has been permitted or denied. Unfortunately, the sheer volume of data from even a moderately sized environment can quickly become unmanageable. Most firewalls use one of two types of logging methods Syslog Implemented by most firewalls and uses a relatively simple UDP-based (although the Cisco Secure PIX Firewall also supports TCP) client server logging method. Open Platform for Security Log Export Application Programming Interface (OPSEC...

Example 141 Using Telnet to Access a Server on TCP Port 443 HTTPS

< DOCTYPE HTML PUBLIC - IETF DTD HTML 2.0 EN> < title> 400 Bad Request< title> < p> Your browser sent a request that this server could not understand.< br > Reason You're speaking plain HTTP to an SSL-enabled server port. Instead use the HTTPS scheme to access this URL, please.< br > < blockquote> Hint < a < address> Apache 2.0.52 (Unix) mod ssl 2.0.52 OpenSSL 0.9.7d DAV 2 www.innocentvictimcompany.com Port 443< address> Connection to 10.16.17.223 closed by...

Firewall Log Review and Analysis

After the decision has been made to log events from your firewall, the next step is determining what be looking for in the logs and how you should properly perform log analysis. The most important thi remember is that firewall logs are virtually worthless if no one ever looks at the logs. Logging is mei to an end, namely knowing what is going on with your firewalls so that you can respond accordingly the logs should not be reserved for only when an incident has occurred. It should be a part of...

Figure 79 Webmin Firewall Modules

The focus during this discussion is on the Linux Firewall module because the Shoreline Firewall module requires the installation of additional files from the Shorewall project (http www.shorewall.net). Webmin enables administrators to control all three tables in NetFilterfilter, mangle, and NATthrough either the Linux Firewall Webmin module or the Shorewall Webmin module, as shown in Figure 7-10.

Figure 52 Port Range Forwarding

Internal I lost (Host A) 10.1.1.1 DO Hns A responds to 20& .155.202 accordingly, whh ir e rauler using NAT to fransiale Internal I lost (Host A) 10.1.1.1 DO H sl BaLleinpls to conreot tn 2G& .1C5.201.1 over TCP port 3D 209 165 20U and 1ran& la1es ar d forwards n lo th& iiamal su er ai IP address 10.1.1 100 Lxtemal Hosl (Host S) 209.165.202.130 H sl BaLleinpls to conreot tn 2G& .1C5.201.1 over TCP port 3D 209 165 20U and 1ran& la1es ar d forwards n lo th& iiamal su er ai IP...

Internet Firewall with a Single DMZ

The Internet firewall with a single DMZ is the most common firewall architecture, because it lends itself to being an all-around general-purpose architecture. With this architecture, the firewall has three interfaces an internal interface that is connected to the protected network, an external interface that is connected to the Internet, and a DMZ interface that is connected to a screened subnet upon which reside the servers and systems that external users need to access. Because the resources...