Firewall Facts

Question 1

Firewall

Answer 1

• Software or hardware based network security system that allows or denies network traffic according to a set of rules

Question 2

Network based firewall

Answer 2

• Is installed on the edge of a private network or network segment

Question 3

Network based firewall facts

Answer 3

• Are considered hardware firewalls - even though they use a combination of hardware and software to protect the network from Internet attacks

Question 4

Host based firewall

Answer 4

• Installed on a single computer in a network

Question 5

Host based firewall facts

Answer 5

• Almost all host-based firewalls are software firewalls
• Can be used to protect a computer when no network-based firewall exist(e.g. when connected to a public network)
• Less expensive and easier to use than network-based firewalls, but the don’t offer the same level of protection or customization

Question 6

ACL’s

Answer 6

• Filtering rules to identify allowed and blocked traffic

Question 7

ACL characteristics of traffic

Answer 7

• The interface the rule applies to
• The direction of traffic (inbound or outbound)
• Packet information such as the source of destination IP address or port number
• The action to take when the traffic matches the filter criteria

Question 8

Does firewall offer protection against all attacks

Answer 8

No example email spoofing

Question 9

Packet Filtering Firewall

Answer 9

• Makes decisions about which network traffic t allow by examining information in the IP packet header such as source and destination addresses, ports, and service protocols

Question 10

Packet Filtering Firewall Facts

Answer 10

• Uses ACLs or filter rules to control traffic
• Operates at OSI Layer 3 (Network layer)
• Offers high performance because it examines only the addressing information in the packet header
• Can be implemented using features that are included in most routers
• Is a popular solution because it is easy to implement and maintain, has a minimal impact on system performance and is fairly inexpensive

Question 11

Stateless firewall

Answer 11

• Packet filtering firewall is considered stateless because it examines each packet and uses rules to accept or reject it w/o considering whether the packet is part of a valid and active session

Question 12

Circuit- level proxy

Answer 12

• Makes decisions about which traffic to allow based on virtual circuits or sessions

Question 13

Circuit-level proxy facts

Answer 13

• Operates at OSI Layer 5 (Session)
• Keeps a table of known connections and sessions. Packets directed to known sessions are accepted
• Verifies that packets are properly sequenced
• Ensures that the TCP 3-way handshake process occurs only when appropriate
• Does not filter packets. Instead it allows or denies sessions

Question 14

Stateful firewall

Answer 14

• CLP is considered a stateful firewall because it keeps track of the state of a session.
• CLP can filter traffic that uses dynamic ports because the firewall matches the session information for filtering and not the port numbers.
• CLP are slower than PFF but if only the session state is being used for filtering a CLP can be faster after the initial session information has been identified.

Question 15

Application level gateway

Answer 15

• Is cable of filtering based on information contained within the data portion of a packet

Question 16

Application level gateway facts

Answer 16

• Examines the entirety of the content being transferred(not just individual packets)
• Operates at OSI Layer 7 (Application layer)
• Understands. or interfaces with the application layer protocol
• Can filter based on user group and data (e.g. URLs within an HTTP request)
• Is the slowest form of firewall because entire messages are reassembled at the Application layer

Question 17

Proxy server

Answer 17

• Is an example of an application level gateway

* Is a device that stands as an intermediary between a secure private network and the public

Question 18

Proxy server can be configured to:

Answer 18

• Control both inbound and outbound traffic
• Increased performance by caching frequently accessed content. Content is retrieved from the proxy cache instead of the original server
• Filter content and restrict access depending on the user or specific website
• Shield or hide a private network

Question 19

Name the two types of Proxy Servers

Answer 19

• Forward Proxy Server
• Reverse Proxy Server
• Oftentimes reverse proxies work transparently meaning that clients requesting specific resources don’t know they are using a reverse proxy to access a server

Question 20

Forward Proxy Server

Answer 20

• Handles requests from inside a private network out to the Internet

Question 21

Reverse Proxy Server

Answer 21

• Handles requests from the Internet to a server located inside a private network.
• Can perform load balancing authentication and caching

Question 22

Unified Threat Management (UTM) Device

Answer 22

• Combines multiple security features into a single network appliance

Question 23

UTM security features:

Answer 23

• Firewall
• VPN
• Ant-spam
• Anitvirus
• Load balancing

Question 24

UTM (Pros and Cons)

Answer 24

• By combining serval services into one appliance, UTM devices make managing network security easier
• But they also introduce a single point of failure
• If the UTM fails security is lost
• UTM devices aren’t as robust as other devices made for a specific use

Question 25

UTM devices are best suited for:

Answer 25

* Offices where space limits don't allow for multiple security appliance * Satellite offices that need to be managed remotely. Configuration changes need to be made on only one device rather than multiple devices * Smaller businesses that wouldn't benefit from the robust features provided by specific security appliance

Question 26

Using zones in a firewall

Answer 26

* Each zone identifies a collection of users who have similar access needs * Firewalls are configured at the edge of these zones to filter incoming and outbound traffic * EX. you can define a zone hat includes all hosts on your private network protected from the Internet and you can define another zone within your network for controlled access to specific servers that hold sensitive information

Question 27

Next Generation Firewall (NGFW)

Answer 27

* Combines a traditional firewall with other network device filter functionalities like an application firewall

Question 28

Next Generation Firewall (NGFW) features:

Answer 28

* Is application-aware * Tracks the state of traffic based on layers 2 - 7 * Utilizes an intrusion protection system (IPS) * Tracks the identity of the local traffic device and user (LDAP, RADIUS, and Active Directory) * Can be used in bridged and routed modes * Utilizes external intelligence sources