Firewall Configuration. Firewall Configuration. Solution Firewall Principles

Transcription

1 Configuration Configuration Principles Characteristics Types of s Deployments Principles connectivity is a common component of today s s networks Benefits: Access to wide variety of resources Exposure for company on Risks: Outside world could gain access internal resources If poorly configured, can result in network security breach Solution Implement a Boundary between the and the internal network

2 Characteristics All traffic that navigates between the internal network and the external network must pass through the firewall Only authorized traffic should be allowed to pass The firewall must be immune to penetration On A Direction Control Service Control User Control Behavior Control Auditing Network Address Translation (NAT) Port Mapping On A Direction Control Different rules can be defined for incoming or outgoing traffic Service control Define what protocols can be used. Based on an IP address, Port Address or protocol ID level Any:* Any.* Incoming Rules Web Server:80 Web Server:443 Web Server:80 Web Server:443 Outgoing Rules Any:* Any:* On A User Control Only allows authorized users to pass traffic through firewall or to access resource on internal network Behavior control Sets how applications can be used Mail filter for viruses or specific forms of attachments Auditing Comprehensive reports on actual protocol usage

3 On A Network Address Translation (NAT) Network Address Translation On A Port Mapping Port Mapping Port Limitations Cannot protect against attacks that bypass the firewall Remote Access Services on Modem Types Of s Packet-Filter Circuit-Level s Application-Level with Proxy Service Dynamic Packet Filter s Kernel Proxy s Modem

4 Packet-Filter Analyze traffic at the transport layer of the OSI model Compare each packet to a series of rules for the interface Apply both incoming and outgoing rules Circuit-Level s Each packet that passes through a firewall is A connection request Data being transported across an existing connection Works as a referee to ensure that a proper 3-way handshake takes place, if not, then drops connection A table of valid connections is maintained. Current session state Sequence info for both client and server Circuit-Level s does not permit an end-to to-end connection Establishes two separate connections One between an inner host and the firewall One between an outer host and the firewall Outer Connection Inner Connection Application-Level With Proxy Service Evaluates data at the application level before allowing connection to take place Requires configuration of client hosts Internal client sends request to a proxy server Transparent to user More precise rules can be developed based on actual protocol Achieves performance gains Cache information to reduce external bandwidth usage Create arrays of proxy servers

5 Dynamic Packet Filter s Combines services of application and packet filter firewalls Allows security rules to be created on the fly Provides UDP transport support records info on all UDP packets that cross (source port destination port) Response must be returned to original requestor If this does not occur, drop packets! If not returned in a timely fashion, drop packets! Kernel Proxy s Rules are implemented at kernel level Information is discarded without being passed up the network stack For each new session, a new TCP/IP stack is generated on the fly with the following properties: Contains protocol proxies required only for that session Can be customized to implement investigation of the data transmission Network packet can be re-inspected at each level A packet to be discarded before it reaches the application level Configurations Bastion Host De-Militarized Zones Three-Pronged DMZ Mid-Ground DMZ Bastion Host Used for smaller networks Only purpose is to protect internal network from external network

6 De-Militarized Zone (DMZ) Places all accessible resources in separate segment of network All traffic (inbound and outbound) is screened by administrator-defined defined rules Rules are defined for interaction between all network segments Three-Pronged DMZ Only one firewall required DMZ Private Network Mid-Ground DMZ Might be implemented with two different firewall products More cost, but can be more secure! DMZ External Internal Final Thoughts Careful design is required for a firewall solution Be sure to test all configurations Use a Deny All Except Those Listed methodology Will cover all future protocols Private Network

7 Final Thoughts Test firewall using a security scanner ISS CyberCop Shields Up For Additional Information Web Sites https://www.sans.org/