Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of : Number of Rules, Complexity Of rules, etc. Performance Requirements Traffic Volume (Packets per Second) Log File Permit (Pass) Deny (Drop) Static Packet Filter IP-H IP-H IP-H TCP-H UDP-H Message Message ICMP Message Arriving Packets Examined One at a Time, in Isolation Only IP, TCP, UDP and ICMP Headers Examined 3 4 Ingress Prevent attack packets from entering the protected network Rules are applied in order See Figure 5.6 for generic rule format 5 Ingress Deny Known Fallacious Source Addresses Private addresses 10.*.*.* 172.16.*.* to 172.31.*.*, 192.168.*.* Internal Address Ranges Other obvious or known common addresses 1.2.3.4, 0.0.0.0, 0.0.0.1, etc. 6 1
Ingress Deny Known TCP Vulnerabilities Syn flood (TCP SYN=1 AND FIN=1) (TCP destination port = 20) Supervisory control connection (TCP destination port = 21) Telnet (TCP destination port = 23) NetBIOS (TCP destination port = 135 through 139) UNIX rlogin (TCP destination port = 513) UNIX rsh launch shell without login (TCP port 514) 7 Ingress 1. If UDP destination port=69, DENY [Trivial File Transfer Protocol; no login necessary] 2. If ICMP Type = 0, PASS [allow incoming echo reply messages] 3. DENY ALL 8 Egress Egress Deny Destinations private IP address range = 10.*.*.* 172.16.*.* to 172.31.*.* 192.168.*.* not in internal address range 60.47.*.* 9 Allow ICMP Type = 8, PASS [outgoing echo messages] Deny Protocol=ICMP [all other outgoing ICMP] Deny TCP RST=1[outgoing resets; used in host scanning] 10 Egress Deny Connections to Well-known ports TCP source port=0 through 49151 UDP source port=0 through 49151 Allow Outgoing Connections UDP source port = 49152 65,536 TCP source port =49152 through 65,536 11 s Types of s Inspection Methods Static Packet Inspection Stateful Packet Inspection NAT s Architecture Configuring, Testing, and Maintenance 12 2
Stateful Inspection s State of Connection Open or Closed State Order of packet within a dialog Often simply whether the packet is Stateful Inspection s By default, permit connections openings from internal clients to external servers By default, deny connection openings from the outside to inside servers Default behaviors can be changed with ACLs Accept future packets between hosts and ports in open connections with little or no more inspection 13 14 part of an open connection Stateful Inspection s Can prevent Syn flood Port switching Session hijacking Network Address Translation Hides the IP address of internal hosts to thwart sniffers Benignly spoofs source IP addresses in outgoing packets Etc. 15 16 192.168.5.7 Network Address Translation (NAT) From 192.168.5.7, Port 61000 From 60.5.9.8, 1 Port 55380 2 4 To 192.168.5.7, Port 61000 NAT Translation Table 3 To 60.5.9.8, Port 55380 Internal IP Addr Port 192.168.5.7 61000...... Sniffer Server Host IP Addr Port 60.5.9.8 55380...... 17 Operation 1. HTTP Request From 2. Browser HTTP 18 3
Operation Operation 3. Examined HTTP Request From 4. HTTP Browser HTTP Response to 5. on Post Out, Hostname, URL, MIME, etc. In 19 6. Examined Browser HTTP HTTP 5. Response To on Post Out, Hostname, URL, MIME, etc. In 20 13 Operation Browser HTTP Need one Program On the For Each Protocol Filtered Header Destruction With s Arriving Packet App MSG (HTTP) XOrig. Orig. TCP IP Hdr Hdr Header Removed App MSG (HTTP) App MSG (HTTP) New Packet New TCP Hdr New IP Hdr 21 Attacker 1.2.3.4 Strips Original Headers from Arriving Packets Creates New Packet with New Headers This Stops All Header-Based Packet Attacks 22 Protocol Spoofing Circuit Trojan Horse Internal 60.55.33.12 1. Trojan Transmits on Port 80 to Get Through Simple Packet Filter 2. Protocol is Not HTTP Stops The Transmission X Attacker 1.2.3.4 60.80.5.34 3. Passed TransmissionNo 4. Reply Circuit (SOCKS v5) 60.34.3.31 1. Authentication 2. Transmission 5. Passed ReplyNo 123.30.82.5 23 24 4
Single-Site Architecture for a Larger Firm with a Single Site 2. Main 3. Internal Last Rule=Deny All Traffic Between Subnets 4. Host Marketing on 172.18.5.x Subnet 172.18.9.x Subnet Accounting Server on 172.18.7.x Subnet DMZ 1. Screening Router 60.47.1.1 Last Rule=Permit All Public 60.47.3.9 Relay 60.47.3.10 DNS Server 60.47.3.4 HTTP Server 60.47.3.1 25 DMZ Demilitarized Zone For Servers That Must be Accessed From the Outside Public webservers (proxy) firewalls DNS server that only knows the IP addresses of hosts in the firewall Hosts must be specially hardened because they certainly will be attacked 26 Home SOHO Router Service Provider Always-On Connection Coaxial Cable Broadband Modem Cord PC Home PC Service Provider Ethernet Switch Broadband SOHO Modem Router (DSL or --- Cable) Router DHCP Sever, NAT, and Limited User PC User PC 27 Many Access Routers Combine the Router and Ethernet Switch in a Single Box User PC 28 SOHO: Small office or home owner Distributed Architecture Management Console Home PC 21Other Security Architecture Issues Host and Security (Chapters 6 and 9) Antivirus Protection (Chapter 4) Intrusion Detection Systems (Chapter 10) Virtual Private Networks (Chapter 8) Policy Enforcement System Site A Site B 29 30 5
22Configuring, Testing, and Maintaining s Misconfiguration is a Serious Problem ACL rules must be executed in series Easy to make misordering problems Easy to make syntax errors 22Configuring, Testing, and Maintaining s Create Policies Before ACLs Policies are easier to read than ACLs Can be reviewed by others more easily than ACLs Policies drive ACL development Policies also drive testing 31 32 22Configuring, Testing, and Maintaining s Must test s with Security Audits Only way to tell if policies are being supported Must be driven by policies Maintaining s New threats appear constantly ACLs must be updated constantly if firewall is Module (GUI) Create, Edit Policies 23FireWall-1 Modular Management Architecture Log Files Management Module Stores Policies Stores Log Files Module Module Enforces Policy (GUI) Sends Log Read Log Files Entries to be effective 33 34 Policy Log File Data Policy Log File Entry Module Enforces Policy Sends Log Entries Internal 24FireWall-1 Service Architecture 2. Statefully Filtered Packet 3. DoS Protection Optional Authentications FireWall-1 1. Arriving Packet 4. Content Vectoring Protocol Server 25Security Level-Based Stateful in PIX s Security Level Inside=100 Automatically Accept Connection Security Level Outside=0 Automatically Reject Connection Security Level=60 Router Internal Network 5. Statefully Filtered Packet Plus Inspection Third-Party Inspection 35 Connections Are Allowed from More Secure Networks to Less Secure Networks 36 6
Questions? 37 7