Firewalls and LANs

Question 1

Firewalls

Answer 1

Inspect incoming IP packets and block the packets that could hurt the hosts on the LAN. Three methods: stateless, stateful, and application-based, then next-generation firewalls

Question 2

Stateless firewall

Answer 2

Looks at every incoming packet individually without considering anything else taking place, no context (stateless). Are packet filters. oldest type of firewall. Has some form of checklist, the ACL (access control list).
Commonly filters based on things like IP address, Port number, Time/Date.
Can easily combine filters. They are simple and work well. They fail where inspecting and blocking without considering the state isn’t helpful.
Implicit deny. By default there is no access unless the ACL specifically allows it.

Question 3

Stateful Firewall

Answer 3

Understands procedures and processes of different Internet protocols and filters any form of communication outside of proper procedures.
Collect several packets in a connection, look at them as a state to determine if the communication meets correct protocol steps.
Don’t have ACLs. Come from the manufacturer with state smarts. Turn them on or off.

Question 4

Application Firewall

Answer 4

Deep understanding of both stateful and stateless aspects of a specific application (HTTP is the most common type of application firewall) and can filter any traffic for that appication that could threaten it.
Application firewall is an appliance, a box, or network device that works at all layers and can inspect data in protocols.
Typically acts as a content/URL filter, blocking traffic based on traffic content and source URL. Can be host-based or network based. Host based more releant.
Looks at both CONTEXT and CONTENT. Not just one or the other.
WAFs

Question 5

Appliance-based firewall

Answer 5

Dedicated hardware box

Question 6

host-based firewall

Answer 6

Software running on a workstation

Question 7

Virtual firewall

Answer 7

software running in a virtual machine to handle firewall duties

Question 8

Application firewalls primary job

Answer 8

protect public-facing servers providing specific applications, application-based firewalls

Question 9

Stateless and stateful firewalls

Answer 9

Mainly protect LANs from many evils from the Internet, usually called network-based firewalls

Question 10

Next-Generation Firewall (NGFW)

Answer 10

Functions at multiple layers to tackle traffic no traditional firewall can filter alone. Can filter based on IP addresses, port numbers, contents of application data, and more. Implements all sorts of traffic inspection policies at all layers. Ethernet rules, NAT rules, HTTPS rules. Can grab and decrypt SSL/TLS traffic (HTTPS) and inspect it. Can