Firewall and Network Security, Lecture notes of Network Technologies and TCP/IP

Download Firewall and Network Security and more Lecture notes Network Technologies and TCP/IP in PDF only on Docsity!

Firewall

Chun-Jen (James) Chung

Arizona State University

What is a Firewall?

• A component or set of components that restricts access between a protected network and the Internet, or between other sets of networks.
• A choke point to control and monitor incoming/outgoing traffic.
• Interconnects networks with differing trust.
• Imposes restrictions on network services  only authorized traffic is allowed.
• Auditing and controlling access.
• Provides perimeter defense

Firewall Architecture

• Single-Box Architecture

• Screening Router
• Dual-Homed Host
• Multiple-Purpose Boxes

• Screened Host Architecture

• Screened Subnet Architecture

D. Brent Chapman & Elizabeth D. Zwicky, “ Building Internet Firewalls ”, O’Reilly, 2000, http://oreilly.com/catalog/fire/chapter/ch04.html

Screening Router

• Screening Router : the type of router used in a packet filtering firewall.
• Packet filtering : selectively routes packets between internal and external hosts according to rules that reflect the organization's network security policy.
• The screening router passes/rejects an packet based on information contained on the packet‘s header (IP addresses and TCP/UDP ports).

Dual-Homed Host

• Dual-homed host : a computer with at least two network interfaces.
• It could act as a router, but usually the routing functions are disabled. − No external packets can reach to the internal network
• It can only provide services by proxying them, or by having users log into the dual-homed host directly. − Major issue: user accounts
• Proxying is much less problematic, but may not be available for all services you're interested in.

Screened Host Architecture

• Two major components: − Screening router provides packet filtering functions − Bastion host is the only system on the internal network that allows the connection from Internet.
• The bastion host thus needs to maintain a high level of host security.
• Screened host architecture provides both better security and better usability than the dual-homed host architecture. Why?

Interior Router vs. Exterior Router

• The exterior router (access router)
  • tend to allow almost anything outbound from the perimeter net, and the generally do very little packet filtering.
  • Special rules to protect the hosts on the perimeter net.
• The interior router (choke router) does most of the packet
  • It allows selected services from the internal to the Internet. These services can safely support and safely provide using packet filtering rather than proxies.

Multiple Bastion Hosts

Merge Bastion Host and the

Exterior Router

Merge Bastion Host and the

Interior Router

Multiple Internal Networks

(separate interfaces in a single router)

16

Multiple Internal Networks

(backbone architecture)

17

Multiple Perimeter Networks

Classification of Firewall

Characterized by protocol level it controls in

• Packet filters

• Circuit gateways

• Application gateways

• Dynamic packet filters