DOCSLIB.ORG

Check Point Software Technologies, Inc

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Check Point Software Technologies, Inc FireWall-1_GX.book Page 1 Tuesday, March 27, 2007 10:03 AM FireWall-1 GX Administration Guide Version 4.0 October 2006 FireWall-1_GX.book Page 2 Tuesday, March 27, 2007 10:03 AM FireWall-1_GX.book Page 3 Tuesday, March 27, 2007 10:03 AM © 2003-2006 Check Point Software Technologies Ltd. All rights reserved. This product and related documentation are protected by copyright and distributed under licensing restricting their use, copying, distribution, and decompilation. No part of this product or related documentation may be reproduced in any form or by any means without prior written authorization of Check Point. While every precaution has been taken in the preparation of this book, Check Point assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice. RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013 and FAR 52.227-19. TRADEMARKS: ©2003-2006 Check Point Software Technologies Ltd. All rights reserved. Check Point, Application Intelligence, Check Point Express, the Check Point logo, AlertAdvisor, ClusterXL, Cooperative Enforcement, ConnectControl, Connectra, CoSa, Cooperative Security Alliance, Eventia, Eventia Analyzer, FireWall-1, FireWall-1 GX, FireWall-1 SecureServer, FloodGate-1, Hacker ID, IMsecure, INSPECT, INSPECT XL, Integrity, InterSpect, IQ Engine, Open Security Extension, OPSEC, Policy Lifecycle Management, Provider-1, Safe@Home, Safe@Office, SecureClient, SecureKnowledge, SecurePlatform, SecuRemote, SecureXL Turbocard, SecureServer, SecureUpdate, SecureXL, SiteManager-1, SmartCenter, SmartCenter Pro, Smarter Security, SmartDashboard, SmartDefense, SmartLSM, SmartMap, SmartUpdate, SmartView, SmartView Monitor, SmartView Reporter, SmartView Status, SmartViewTracker, SofaWare, SSL Network Extender, Stateful Clustering, TrueVector, Turboc ard, UAM, User-to-Address Mapping, UserAuthority, VPN-1, VPN-1 Accelerator Card, VPN-1 Edge, VPN-1 Pro, VPN-1 SecureClient, VPN-1 SecuRemote, VPN-1 SecureServer, VPN-1 VSX, VPN-1 XL, Web Intelligence, ZoneAlarm, ZoneAlarm Pro, Zone Labs, and the Zone Labs logo, are trademarks or registered trademark s of Check Point Software Technologies Ltd. or its affiliates. All other product names mentioned herein are trademarks or registered trademarks of their respective owners. The products described in this document are protected by U.S. Patent No. 5,606,668, 5,835,726, 6,496,935 and 6,850,943 and may be protected by other U.S. Patents, foreign patents, or pending applications. For third party notices, see THIRD PARTY TRADEMARKS AND COPYRIGHTS. FireWall-1_GX.book Page 4 Tuesday, March 27, 2007 10:03 AM FireWall-1_GX.book Page 5 Tuesday, March 27, 2007 10:03 AM Contents Preface Who Should Use This Guide.............................................................................. 10 Summary of Contents....................................................................................... 11 Appendices ................................................................................................ 11 More Information ............................................................................................. 12 Chapter 1 GPRS/UMTS Overview A Global System for Mobile Communications...................................................... 14 General Packet Radio Services .......................................................................... 15 Universal Mobile Telecommunications System.................................................... 16 IP Multimedia Subsystem................................................................................. 17 Basic Components of GPRS/UMTS Networks ...................................................... 18 On the Network .......................................................................................... 18 Interfaces................................................................................................... 19 Signalling Protocol...................................................................................... 19 Comparing GTP Versions 0 and 1 ...................................................................... 21 Port Changes.............................................................................................. 21 Multiple PDP Contexts for the Same PDP Address.......................................... 21 Secondary PDP Context Activation................................................................ 22 Tunnel Update Initiated by the GGSN........................................................... 22 Delete Teardown Flag.................................................................................. 22 Chapter 2 Introducing FireWall-1 GX The Need for Security on GPRS/UMTS Networks................................................. 24 GTP - Insecure By Design ............................................................................ 24 Check Point Protects GPRS/UMTS Networks ...................................................... 25 The Check Point GPRS/UMTS Commitment................................................... 25 Overview of FireWall-1 GX............................................................................ 26 Logging, Alerts, and Reporting ..................................................................... 26 Before Installing FireWall-1 GX .................................................................... 26 Deploying FireWall-1 GX................................................................................... 27 Chapter 3 Securing GPRS/UMTS Networks Introduction to Securing GPRS/UMTS Networks.................................................. 30 GTP Protocol Security ...................................................................................... 31 Introduction to GTP Protocol Security ........................................................... 31 Understanding the Overbilling Attack............................................................ 31 Deleting PDP Contexts From the Command Line ............................................ 33 GTP-Aware Security Policy................................................................................ 34 Introduction to GTP-Aware Security Policy..................................................... 34 GSN Address Filtering ................................................................................. 34 GTP Tunnel Management/ User Traffic.......................................................... 35 Table of Contents 5 FireWall-1_GX.book Page 6 Tuesday, March 27, 2007 10:03 AM GTP Path Management Message Support ...................................................... 38 GTP Mobility Management Message Support ................................................. 39 Dynamic Configuration of New GTP Messages and Information Elements ......... 40 Intra-Tunnel Inspection .................................................................................... 41 Introduction to Intra-Tunnel Inspection......................................................... 41 GTP Address Anti-Spoofing.......................................................................... 41 Block GTP in GTP....................................................................................... 42 MS to Gn Network Policy Enforcement.......................................................... 43 APN Domain End User Address Enforcement................................................. 43 Wildcard APN Matching .............................................................................. 44 MS to MS Policy Enforcement...................................................................... 44 Mobile Subscriber Traffic Security..................................................................... 46 Cellular Specific Services ................................................................................. 47 WAP.......................................................................................................... 47 MMS Over WAP .......................................................................................... 47 Configuring Security......................................................................................... 48 Creating a Basic Security Policy ................................................................... 48 Enabling Overbilling Attack Protection .......................................................... 54 Enforcing a More Granular GTP Security Policy.............................................. 58 Using FW SAM to Close PDP Contexts .......................................................... 69 Adding Support for New GTP Messages and Information Elements .................. 71 Adjusting Settings with GUI Dbedit .............................................................. 72 Chapter 4 Using QoS to Manage GTP Bandwidth Introduction to GTP Bandwidth Management using QoS ...................................... 76 How it Works................................................................................................... 77 Unsupported Features ...................................................................................... 79 Configuring QoS with FireWall-1 GX................................................................... 80 Chapter 5 Monitoring GPRS Network Security Introduction to Monitoring GPRS Network Security ............................................. 82 GTP Tracking Logs and Alerts ..........................................................................
Load more

Recommended publications
  • Adaptive Distributed Firewall Using Intrusion Detection Lars Strand
    UNIVERSITY OF OSLO Department of Informatics Adaptive distributed firewall using intrusion detection Lars Strand UniK University Graduate Center University of Oslo lars (at) unik no 1. November 2004 ABSTRACT Conventional firewalls rely on a strict outside/inside topology where the gateway(s) enforce some sort of traffic filtering. Some claims that with the evolving connectivity of the Internet, the tradi- tional firewall has been obsolete. High speed links, dynamic topology, end-to-end encryption, threat from internal users are all issues that must be addressed. Steven M. Bellovin was the first to propose a “distributed firewall” that addresses these shortcomings. In this master thesis, the design and implementation of a “distributed firewall” with an intrusion detection mechanism is presented using Python and a scriptable firewall (IPTables, IPFW, netsh). PREFACE This thesis is written as a part of my master degree in Computer Science at the University of Oslo, Department of Informatics. The thesis is written at the Norwegian Defence Research Establishment (FFI). Scripting has been one of my favourite activities since I first learned it. Combined with the art of Computer Security, which I find fascinating and non-exhaustive, it had to be an explosive combina- tion. My problem next was to find someone to supervise me. This is where Professor Hans Petter Langtangen at Simula Research Laboratory and Geir Hallingstad, researcher at FFI, stepped in. Hans Petter Langtangen is a masterful scripting guru and truly deserves the title “Hacker”. Geir Hallingstad is expert in the field of computer/network security and gave valuable input and support when designing this prototype.
    [Show full text]
  • Avoiding Network and Host Detection Using Packet Bit-Masking
    Avoiding Network and Host Detection using Packet Bit-masking George Stergiopoulos a, Eirini Lygerou, Nikolaos Tsalis, Dimitris Tomaras and Dimitris Gritzalis Information Security & Critical Infrastructure Protection Laboratory, Department of Informatics, Athens University of Economics & Business, 76 Patission Ave., Athens GR-10434, Greece Keywords: Network Security, Detection, Attack, Evasion, Intrusion Detection, Host, Siem, Malware, TCP, Packet, Transport, Layer, Payload, Shell, Data Leakage, DLP. Abstract: Current host and network intrusion detection and prevention systems mainly use deep packet inspection, sig- nature analysis and behavior analytics on traffic and relevant software to detect and prevent malicious activity. Solutions are applied on both system and network level. We present an evasion attack to remotely control a shell and/or exfiltrate sensitive data that manages to avoid most popular host and network intrusion techniques. The idea is to use legitimate traffic and victim-generated packets that belong to different contexts and reuse it to communicate malicious content without tampering their payload or other information (except destination IP). We name the technique “bit-masking”. The attack seems able to exfiltrate any amount of data and execution time does not seem to affect detection rates. For proof, we develop the “Leaky-Faucet” software that allows us to (i) remotely control a reverse shell and (ii) transfer data unnoticed. The validation scope for the presented attack includes evading 5 popular NIDS, 8 of the most popular integrated end-point protection solutions and a Data Leakage Prevention system (DLP); both on the network and host session level. We present three different variations of the attack able to transfer (i) shell commands, (ii) large chunks of data, and (iii) malicious code to a remote command and control (CnC) center.
    [Show full text]
  • DISTRIBUTED FIREWALL: a WAY of DATA SECURITY in LOCAL AREA NETWORK Satinder1, Vinay2 1Assistant Professor (Extn.), Department of Computer Science, Govt
    International Journal of Advance Research In Science And Engineering http://www.ijarse.com IJARSE, Vol. No.4, Special Issue (01), April 2015 ISSN-2319-8354(E) DISTRIBUTED FIREWALL: A WAY OF DATA SECURITY IN LOCAL AREA NETWORK Satinder1, Vinay2 1Assistant Professor (Extn.), Department of Computer Science, Govt. College For Women, Hisar, Haryana, INDIA 2Computer Programmer, Computer Section, College of Basic Sciences & Humanities, CCS HAU, Hisar, Haryana, INDIA ABSTRACT Today, Computer and Internet network are essential part of our life. A number of personal transaction occur every second and computer network are mostly used only for transmission of information rather than processing. So, network security is essentialfor avert hacking of our confidential or important information. Network security can be attained by firewall. Firewall is a system or a group of system that implement a set of security rules to apply access control between two networks to protect inside network from outside network. In Short, we can say that, Firewall is a set of software programming and hardware device to secure host computer. A firewall is typically placed at the extremity of a system and act as filter for an illegitimate traffic. But, Conventional firewalls trust on the notions of restricted topology restriction and controlled entry points to apply traffic filtering.There are some problems for restricting the network topology i.e. End-to-End encryption problems, filtering of some protocols.Distributed firewallprotect from hackers attacks that originate from both the Internet and the internal network.Italso protect the client'scomputer and network's serversfrom unwanted hackers and intrusion.In this paper, we introduce the concept of distributed firewall.
    [Show full text]
  • Data Security Based on Lan Using Distributed Firewall
    Jayshri V.Gaud et al, International Journal of Computer Science and Mobile Computing, Vol.3 Issue.3, March- 2014, pg. 386-391 Available Online at www.ijcsmc.com International Journal of Computer Science and Mobile Computing A Monthly Journal of Computer Science and Information Technology ISSN 2320–088X IJCSMC, Vol. 3, Issue. 3, March 2014, pg.386 – 391 RESEARCH ARTICLE DATA SECURITY BASED ON LAN USING DISTRIBUTED FIREWALL Jayshri V.Gaud1, Mahip M.Bartere2 ¹Department of Computer Science & Amravati University, India ²Department of Computer Science & Amravati University, India 1 [email protected]; 2 [email protected] Abstract— Network security consists of the provisions and policies adopted by a network administrator to prevent and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources. In most of the systems, the network security is achieved by firewall and acts as a filter for unauthorized traffic. But there are some problems with these traditional firewalls like they rely on the notation of restricted topology and controlled entry points to function. Restricting the network topology, difficulty in filtering of certain protocols, end-to-end encryption problem and few more problems lead to the evolution of Distributed Firewalls. It secures the network by protecting critical network endpoints, exactly where hackers want to penetrate. This paper is a survey paper, dealing with the general concepts such distributed firewalls, its requirements and implications and introduce, its suitability to common threats on the Internet, as well as give a short discussion on contemporary implementations. A distributed firewall gives complete security to the network.
    [Show full text]
  • Distributed Firewall with Dynamic Intrusion Detection Module
    International Journal of Advanced Research in Engineering and Technology (IJARET) Volume 12, Issue 4, April 2021, pp. 484-491, Article ID: IJARET_12_04_046 Available online at https://iaeme.com/Home/issue/IJARET?Volume=12&Issue=4 ISSN Print: 0976-6480 and ISSN Online: 0976-6499 DOI: 10.34218/IJARET.12.4.2021.046 © IAEME Publication Scopus Indexed DISTRIBUTED FIREWALL WITH DYNAMIC INTRUSION DETECTION MODULE Dr. Zalte S.S. Department of Computer Science, Shivaji University, Kolhapur, India Patil P.N Department of Computer Science, Vishwakarma College of Arts, Commerce and Science, Pune, India Deshmukh S.N. Department of Computer Science, Vishwakarma College of Arts, Commerce and Science, Pune, India ABSTRACT Computers and Internet, both are becoming an essential part of life. With computer networks we are sharing resources, exchanging information, and number of personal transactions which must be secured from unauthorized access, with Network Security we can prevent and detect unauthorized access. So, we can maintain integrity, confidentiality and accessibility of computer networks. One way to achieve Network Security is FIREWALL. A firewall is a system which monitors and filters traffic and gives entry/ blocks data packets based on a set of security rules. Distributed firewall is introduced to eliminate the problems which are difficult to solved in conventional firewalls. Distributed firewall is not restricted by topology and entry point as conventional firewall. Distributed firewall secure critical network endpoints, it provides unlimited Scalability and overcomes single point of failure problems. In this paper, we have proposed Distributed Firewall with Dynamic Intrusion Detection Module to achieve elevated security to the network. Key words: Network Security, Distributed Firewall, computer networks, Policy, Threats, Intrusion Detection.
    [Show full text]
  • DATA SECURITY in LAN USING DISTRIBUTED FIREWALL Dr.T.Pandikumar1, Mekonnen Gidey2
    International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395 -0056 Volume: 04 Issue: 05 | May -2017 www.irjet.net p-ISSN: 2395-0072 DATA SECURITY IN LAN USING DISTRIBUTED FIREWALL Dr.T.Pandikumar1, Mekonnen Gidey2 1Associate Professor, Department of Computer & IT, Defence University, Ethiopia 2M.Tech, Department of Computer & IT, Defence University, Ethiopia ---------------------------------------------------------------------***--------------------------------------------------------------------- Abstract - Computers and Networking have become outside world through wide area networks and the inseparable by now. A number of confidential transactions internet. occur every second and today computers are used mostly Traditional firewalls ( Conventional firewalls ) are for transmission rather than processing of data. So devices often placed on the edge of the network that act Network Security is needed to prevent hacking of data and as a bouncer allowing only certain types of traffic in and to provide authenticated data transfer. Distributed out of the network which often called perimeter firewalls secure the network by protecting critical firewalls. They divide the network into two parts; network endpoints, exactly where hackers want to trusted on one side and un-trusted on the other side. penetrate. It filters traffic from both the Internet and the For this reason they depend heavily on the topology of internal network because the most destructive and costly the network. Moreover, firewalls are a mechanism for hacking attacks still originate from within the policy control and permit a site administrator to set a organization. They provide virtually unlimited scalability. policy on external access. Just as file permissions In addition, they overcome the single point-of-failure enforces an internal security policy and can enforces an problem presented by the perimeter firewall.
    [Show full text]
  • Providing Security and Privacy in Cloud Computing Using Distributed Firewall and VPN
    International Journal of Science and Research (IJSR) ISSN (Online): 2319-7064 Index Copernicus Value (2013): 6.14 | Impact Factor (2014): 5.611 Providing Security and Privacy in Cloud Computing Using Distributed Firewall and VPN Dr. Chinthagunta Mukundha1, Dr. I. Surya Prabha2 1Associate Professor, IT Department, Sreenidhi Institute of Science and Technology, Hyd -500043, Andhra Pradesh, India 2Professor, IT Department, Institute of Aeronautical Engineering, Hyd -500043, Andhra Pradesh, India Abstract: Cloud Computing is a flexible, cost-effective, and proven delivery platform for providing business or consumer IT services over the Internet. The main interest is to investigate the impact of using Virtual Private Network VPN together with firewall on cloud computing performance. Therefore, computer modeling and simulation of cloud computing with OPNET modular simulator has been conducted for the cases of cloud computing with and without VPN and firewall. However, cloud Computing presents an added level of risk because essential services are often outsourced to a third party, which makes it harder to maintain data security and privacy, support data and service availability, and demonstrate compliance. Cloud Computing leverages many technologies it also inherits their security issues cloud involves defined interaction with SLA based policies for the resource and service usages. If someone violates these rules the protection level of system gets compromised. Traditional security of the system is handled by the firewall. They are made for a static and fixed environment having limited policies and interactions. But in cloud environments the scenarios are changed totally and hence the behavior of firewall might also get adaptive as per the need of cloud computing.
    [Show full text]
  • Distributed Perimeter Firewall Policy Management Framework
    DISTRIBUTED PERIMETER FIREWALL POLICY MANAGEMENT FRAMEWORK A DISSERTATION IN Computer Science and Telecommunications and Computer Networking Presented to the Faculty of the University of Missouri-Kansas City in partial fulfillment of the requirements for the degree DOCTOR OF PHILOSOPHY by MAHESH NATH MADDUMALA M.Tech., Andhra University, India, 2007 B.Tech., M.L.Engineering College, India, 2004 Kansas City, Missouri 2017 © 2017 MAHESH NATH MADDUMALA ALL RIGHTS RESERVED DISTRIBUTED PERIMETER FIREWALL POLICY MANAGEMENT FRAMEWORK Mahesh Nath Maddumala, Candidate for the Doctor of Philosophy Degree University of Missouri-Kansas City, 2017 ABSTRACT A perimeter firewall is the first line of defense that stops unwanted packets (based on defined firewall policies) entering the organization that deploys it. In the real world, every organization maintains a perimeter firewall between internet (which could be untrusted) and its own network (private network). In addition, organizations maintain internal firewalls to safeguard individual departments and data center servers based on various security and privacy requirements. In general, if we consider firewall setup in multinational organization's network environment, every branch has perimeter firewall and a set of internal firewalls. Every branch has its own security policies defined based on its specific security requirements, type of information, information processing systems, location-based compliance requirements, etc. As the branches of the multinational organizations span across the globe, managing the policies at every branch and ensuring the compliance and consistency of security policies are quite complex. Any misconfiguration of firewall policies even at a single branch may pose risk to the overall organization in terms of financial loss and reputation.
    [Show full text]
  • Deep Edge 2.5 Service Pack 2 Administrator's Guide
    Trend Micro Incorporated reserves the right to make changes to this document and to the product described herein without notice. Before installing and using the product, review the readme files, release notes, and/or the latest version of the applicable documentation, which are available from the Trend Micro website at: http://docs.trendmicro.com/en-us/home.aspx © 2014 Trend Micro Incorporated. All Rights Reserved.Trend Micro, the Trend Micro t-ball logo, Trend Micro Antivirus, Deep Discovery, TrendLabs, TrendEdge, and Smart Protection Network are trademarks or registered trademarks of Trend Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Document Part No.: CTEM26692_140930 Release Date: November 2014 Protected by U.S. Patent No.: Patents pending. This documentation introduces the main features of the product and/or provides installation instructions for a production environment. Read through the documentation before installing or using the product. Detailed information about how to use specific features within the product may be available in the Trend Micro Online Help and/or the Trend Micro Knowledge Base at the Trend Micro website. Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please contact us at [email protected]. Evaluate this documentation on the following site: http://www.trendmicro.com/download/documentation/rating.asp Table of Contents About This Manual About This
    [Show full text]
  • Network Security Firewalls & Vpns
    CS 419: Computer Security Week 11: Network Security Firewalls & VPNs © 2020 Paul Krzyzanowski. No part of this Paul Krzyzanowski content, may be reproduced or reposted in whole or in part in any manner without the permission of the copyright owner. Network Security Goals • Confidentiality: sensitive data & systems not accessible • Integrity: data not modified during transmission • Availability: systems should remain accessible Gateway Router Internal subnet Internet Dragon artwork by Jim Nelson. © 2012 Paizo Publishing, LLC. Used with permission. November 17, 2020 CS 419 © 2020 Paul Krzyzanowski 2 Firewalls November 17, 2020 CS 419 © 2020 Paul Krzyzanowski 3 Firewall • Separate your local network from the Internet – Protect the border between trusted internal networks and the untrusted Internet • Approaches – Packet filters – Application proxies – Intrusion detection / intrusion protection systems November 17, 2020 CS 419 © 2020 Paul Krzyzanowski 4 Packet Filters November 17, 2020 CS 419 © 2020 Paul Krzyzanowski 5 Screening router Border router (gateway router) – Router between the internal network(s) and external network(s) – Any traffic between internal & external networks passes through the border router Instead of just routing the packet, decide whether to route it • Screening router = Packet filter Allow or deny packets based on – Incoming & outgoing interfaces – Source & destination IP addresses – Protocol (e.g., TCP, UDP, ICMP, IGMP, RSVP, etc.) – Source & destination TCP/UDP ports, ICMP command November 17, 2020 CS 419 © 2020 Paul
    [Show full text]
  • A Stateful CSG-Based Distributed Firewall Architecture for Robust Distributed Security
    A Stateful CSG-based Distributed Firewall Architecture for Robust Distributed Security V. Ramsurrun, and K. M. S. Soyjaudah Electrical & Electronic Engineering Department University of Mauritius (UoM) Réduit, Mauritius [email protected], [email protected] Abstract —Distributed firewalls have been developed in order to is provided at the very cluster level, the whole of the network provide networks with a higher level of protection than will become more secure as we can reduce the occurrence of traditional firewalling mechanisms like gateway and host-based both insider & external attacks, and limit their spread & effects firewalls. Although distributed firewalls provide higher security, more readily. A 2-active-node stateful CSG is used for they too have limitations. This work presents the design & protecting each end-user cluster in our working prototype. implementation of a new distributed firewall model, based on In this paper, we perform the following: stateful Cluster Security Gateway (CSG) architecture, which addresses those shortcomings. This distributed security model 1. Review of the strengths & limitations of distributed adopts a bottom-up approach such that each cluster of end-user firewalls. hosts is first secured using the CSG architecture. These different 2. Use of the stateful CSG to implement a new robust CSGs are then centrally managed by the Network Administrator. distributed firewall model. A file-based firewall update mechanism is used for dynamic real- time security. IPsec is used to secure the firewall policy update 3. Qualitative comparison of its strengths & weaknesses distribution while X.509 certificates cater for sender/receiver with other major software-based & hardware-based authentication. The major benefits of this approach to distributed distributed firewall architectures available.
    [Show full text]
  • Network Firewalls (Pdf)
    Network Firewalls Kenneth Ingham Stephanie Forrest [email protected] [email protected] University of New Mexico University of New Mexico Santa Fe Institute Department of Computer Science Department of Computer Science 1399 Hyde Park Road MSC01 1130 MSC01 1130 Santa Fe, NM 87501 1 University of New Mexico 1 University of New Mexico Albuquerque, NM 87131-0001 Albuquerque, NM 87131-0001 Contents 1 Introduction 3 2 The Need for Firewalls 7 3 Firewall architectures 9 3.1 Packet filtering . 10 3.1.1 Packet Filtering with State . 11 3.1.2 Improving Packet Filter Specification . 12 3.2 Proxies . 15 4 Firewalls at various ISO network levels 17 4.1 Physical layer . 17 4.2 Data link layer . 18 4.2.1 Filtering on MAC address . 18 4.2.2 Bridging firewalls . 19 4.3 Network . 19 1 4.4 Network- and host-based filtering . 20 4.4.1 Multicast . 20 4.4.2 Network Address Translation . 22 4.5 Transport . 23 4.6 Presentation . 23 4.7 Application . 24 5 Other approaches 24 5.1 Distributed Firewalls . 25 5.2 Dynamic firewalls . 26 5.3 Normalization . 26 5.4 Signature-based Firewalls . 27 5.5 Transient Addressing . 27 6 Firewall Testing 28 7 What firewalls do not protect against 29 7.1 Data Which Passes Through the Firewall . 29 7.2 Servers on the DMZ . 31 7.3 Insider Attacks . 31 8 Future Challenges for Firewalls 32 8.1 VPNs . 32 8.2 Peer-to-peer Networking . 32 8.3 HTTP as a “universal transport protocol” . 33 9 Conclusion 33 2 Abstract Firewalls are network devices that enforce an organization’s security policy.
    [Show full text]