1. Security Firewall Firewall design principle. Firewall Characteristics.
Types of Firewalls.
Firewall Components & Configurations.

2. Firewall Design Principles .
Information System undergo a steady evolution( from small LAN’s to Internet connectivity).
Strong security features for all workstations and servers not established.

3. Firewalls
Effective means of protection a local system or network of systems from network_based security threats while affording access to the outside world via WAN’s or the Internet.

4. Firewall Design Principles
The firewall is interested between the permission network and internet.
Aims :
Establish a controlled link.
Protect the premises network from internet_based attacks.
Provide a single choke point.

5. Firewalls Characteristics
Design goals:
All traffic form the inside to outside must pass through the firewall (physically blocking all access to the local network except via firewall).
Only Authorized traffic ( defined by the local security policy) will be allowed to pass.

6. Firewall Characteristics
Design goals:
3. The firewall itself is immune to penetration ( use of trusted systems with secure operating systems).

7. Firewall Characteristics
Four General Technologies:
Service Control: determines the types of the internet services that can be accessed, in bounded or out bounded.
Direction Control: determines the direction in which particular services requests are allowed to flow.

8. Firewall Characteristics
3. User Control: controls access to a service according to which user is attempting to access it.
4. Behavior Control: controls how particular service are used (e.g. filter )

9. Types of Firewalls Three common types of firewalls:
Packet-filtering-router.
Application-level-Gateways.
Circuit-level-Gateways.
(Bastion Host).

10. Packet-Filtering-Router
Packet Filtering Router firewalls.
Private Network
Internet
Packet Filtering Router
Figure ( Packet Filtering Router Firewall).

11. Packet-Filtering-Router
Applies a set of rules to each incoming IP packet and then forwards or discards the packet.
Filter packets going in both directions.
The packet filter is typically set up as a list of rule based on matches to fields in the IP or TCP header.
Two default polices( discards or forwards).

12. Packet-Filtering-Router
Advantages:
Simplicity.
Transparency to users.
High speed
Disadvantages:
Difficulty of setting up packet filter walls.
Lack of Authentication.

13. Application-Level-Gateway
Application Level Gateway Firewall.
Inside Host
TELNET
Outside Host
FTP
SMTP
Outside Connection
Inside Connection
HTTP
Figure (Application Level Gateway).

14. Application-Level-Gateway
Also called (Proxy Server).
Acts as relay of application level traffic.

15. Application-Level-Gateway
Advantages:
Higher security than packet filter
Only need securitize a few allowable applications.
Easy to log and audit all incoming traffic.
Disadvantages:
Additional processing overhead on each connection (Gateway as splice point).

16. Inside host & inside connection Outside host & outside connection
Circuit Level Gateway
Circuit Level Gateway.
OUT IN
Inside host & inside connection
OUT IN
Outside host & outside connection
OUT IN
OUT IN

17. Circuit Level Gateway
Stand-alone system or specialized function performed by Application level gateway.
Sets up two TCP connections.
The gateway typically relays TCP segments from one connection to the other without examining the contents.

18. Circuit Level Gateway
The security function consists of which connections to be allowed.
Typically use is a situation in which the system administrators trusts the internal users.
An example is the SOCKS package.

19. Bastion Host
A system identified by the firewall administrator as critical strong point in the networks security.
The Bastion host serves as a platform for an application-level or circuit-level gateway.

20. Bastion Host
In addition to the use of simple configuration of single system ( single packet filtering router or single gateway), more complex configurations are possible.
Three common configurations

21. Screened host firewall system
Also called single homed bastion host
Packet
Filtering
Router
Internet
Information Server
Private Network
Bastion Host

22. Screened host firewall (1)
Configuration:
Consists of two systems which are:
Packet filtering router.
-Only packets from and to the bastion host are allowed to pass through server.
Bastion Host.
- Authentication and Proxy functions.

23. Screened host firewall (2)
Greater security that the single configuration because of two reasons:
This configuration implements both packet level and application level filtering ( allowing for flexibility in defining security policy).
An intruder must generally penetrate two separate systems.

24. Screened host firewall (3)
This configuration also affords flexibility in providing direct internet access ( public information server, e.g. web server).

25. Dual Homed Bastion Host
Packet
Filtering
Router
INTERNET
Information Server
Private Network
Bastion Host

26. Dual Homed Bastion Host
The packet filtering router is not completely compromised.
Traffic between the internet and other hosts on the private network has to flow through the Bastion host.

27. Screened Subnet Firewall System
Information Server
See Figure.
Modem
Packet
Filtering
Router
Packet
Filtering
Router
INTERNET
Private
Network
Bastion Host

28. Screened Subnet Firewall System
Most secured configuration of all the three known techniques in the bastion host.
Two packet filtering routers are used.
Creation of an isolated sub-network.

29. Screened Subnet Firewall System
Advantages:
Three levels of defense to thwart intruders.
The outside router advertises only the existence of the screened sub-net to the internet ( Internal network is invisible to the internet).

30. Screened Subnet Firewall System
Advantages:
- The inside router advertises only the existence of the screened sub-net to the internal network ( the systems on the inside cannot construct direct routes to the internet.