Presentation is loading. Please wait.

Presentation is loading. Please wait.

Chapter 8: Firewall Configuration and Administration

Published by Modified over 9 years ago

Similar presentations

Presentation on theme: "Chapter 8: Firewall Configuration and Administration"— Presentation transcript:

1 Chapter 8: Firewall Configuration and Administration
ISA 3200 Network Security Chapter 8: Firewall Configuration and Administration

2 Learning Objectives Set up firewall rules that reflect an organization’s overall security approach Identify and implement different firewall configuration strategies Update a firewall to meet new needs and threats Adhere to proven security principles to help the firewall protect network resources IS 3200, Summer 2010 7/12

3 Learning Objectives (continued)
Use a remote management interface Track firewall log files and follow the basic initial steps in responding to security incidents Understand the nature of advanced firewall functions IS 3200, Summer 2010 7/12

4 Establishing Firewall Rules and Restrictions
Rules give firewalls specific criteria for making decisions about whether to allow packets through or drop them All firewalls have a rules file—the most important configuration file on the firewall IS 3200, Summer 2010 7/12

5 The Role of the Rules File
Establishes the order the firewall should follow Tells the firewall which packets should be blocked and which should be allowed Requirements Need for scalability Importance of enabling productivity of end users while maintaining adequate security IS 3200, Summer 2010 7/12

6 Restrictive Firewalls
Block all access by default; permit only specific types of traffic to pass through IS 3200, Summer 2010 7/12

7 Restrictive Firewalls (continued)
Follow the concept of least privilege Spell out services that employees cannot use Use and maintain passwords Choose an approach Open Optimistic Cautious Strict Paranoid IS 3200, Summer 2010 7/12

8 Connectivity-Based Firewalls
Have fewer rules; primary orientation is to let all traffic pass through and then block specific types of traffic IS 3200, Summer 2010 7/12

9 Firewall Configuration Strategies
Criteria Scalable Take communication needs of individual employees into account Deal with IP address needs of the organization IS 3200, Summer 2010 7/12

10 Scalability Provide for the firewall’s growth by recommending a periodic review and upgrading software and hardware as needed IS 3200, Summer 2010 7/12

11 Productivity The stronger and more elaborate the firewall, the slower the data transmissions Important features of firewall: processing and memory resources available to the bastion host IS 3200, Summer 2010 7/12

12 Dealing with IP Address Issues
If service network needs to be privately rather than publicly accessible, which DNS will its component systems use? If you mix public and private addresses, how will Web server and DNS servers communicate? Let the proxy server do the IP forwarding (it’s the security device) IS 3200, Summer 2010 7/12

13 Approaches That Add Functionality to Your Firewall
Network Address Translation (NAT) Port Address Translation (PAT) Encryption Application proxies VPNs Intrusion Detection and Prevention Systems (IDPSs) IS 3200, Summer 2010 7/12

14 NAT/PAT NAT and PAT convert publicly accessible IP addresses to private ones and vice versa; shields IP addresses of computers on the protected network from those on the outside Where NAT converts these addresses on a one-to-one association—internal to external—PAT allows one external address to map to multiple internal addresses IS 3200, Summer 2010 7/12

15 Encryption Takes a request and turns it into gibberish using a private key; exchanges the public key with the recipient firewall or router Recipient decrypts the message and presents it to the end user in understandable form IS 3200, Summer 2010 7/12

16 Encryption (continued)
IS 3200, Summer 2010 7/12

17 Application Proxies Act on behalf of a host; receive requests, rebuild them from scratch, and forward them to the intended location as though the request originated with it (the proxy) Can be set up with either a dual-homed host or a screened host system IS 3200, Summer 2010 7/12

18 Application Proxies (continued)
Dual-homed setup Host that contains the firewall or proxy server software has two interfaces, one to the Internet and one to the internal network being protected Screened subnet system Host that holds proxy server software has a single network interface Packet filters on either side of the host filter out all traffic except that destined for proxy server software IS 3200, Summer 2010 7/12

19 Application Proxies on a Dual-Homed Host
IS 3200, Summer 2010 7/12

20 VPNs Connect internal hosts with specific clients in other organizations Connections are encrypted and limited only to machines with specific IP addresses VPN gateway can: Go on a DMZ Bypass the firewall and connect directly to the internal LAN IS 3200, Summer 2010 7/12

21 VPN Gateway Bypassing the Firewall
IS 3200, Summer 2010 7/12

22 Intrusion Detection and Prevention Systems
Can be installed in external and/or internal routers at the perimeter of the network Built into many popular firewall packages IS 3200, Summer 2010 7/12

23 IDPS Integrated into Perimeter Routers
IS 3200, Summer 2010 7/12

24 IDPS Positioned between Firewall and Internet
IS 3200, Summer 2010 7/12

25 Enabling a Firewall to Meet New Needs
Throughput Scalability Security Recoverability Manageability IS 3200, Summer 2010 7/12

26 Verifying Resources Needed by the Firewall
Ways to track memory and system resources Use the formula: MemoryUsage = ((ConcurrentConnections)/ (AverageLifetime))*(AverageLifetime seconds)*120 Use software’s own monitoring feature IS 3200, Summer 2010 7/12

27 Identifying New Risks Monitor activities and review log files
Check Web sites to keep informed of latest dangers; install patches and updates IS 3200, Summer 2010 7/12

28 Adding Software Updates and Patches
Test updates and patches as soon as you install them Ask vendors (of firewall, VPN appliance, routers, etc.) for notification when security patches are available Check manufacturer’s Web site for security patches and software updates IS 3200, Summer 2010 7/12

29 Adding Hardware Identify network hardware so firewall can include it in routing and protection services Different ways for different firewalls List workstations, routers, VPN appliances, and other gateways you add as the network grows Choose good passwords that you guard closely IS 3200, Summer 2010 7/12

30 Dealing with Complexity on the Network
Distributed firewalls Installed at endpoints of the network, including remote computers that connect to network through VPNs Add complexity Require that you install and/or maintain a variety of firewalls located on your network and in remote locations Add security Protect network from viruses or other attacks that can originate from machines that use VPNs to connect (e.g., remote laptops) IS 3200, Summer 2010 7/12

31 Adhering to Proven Security Principles
Generally Accepted System Security Principles (GASSP) apply to ongoing firewall management Secure physical environment where firewall- related equipment is housed Importance of locking software so that unauthorized users cannot access it IS 3200, Summer 2010 7/12

32 Environmental Management
Measures taken to reduce risks to physical environment where resources are stored Back-up power systems overcome power outages Back-up hardware and software help recover network data and services in case of equipment failure Sprinkler/alarm systems reduce damage from fire Locks guard against theft IS 3200, Summer 2010 7/12

33 BIOS, Boot, and Screen Locks
BIOS and boot-up passwords Supervisor passwords Screen saver passwords IS 3200, Summer 2010 7/12

34 Remote Management Interface
Software that enables you to configure and monitor firewall(s) that are located at different network locations Used to start/stop the firewall or change rule base from locations other than the primary computer IS 3200, Summer 2010 7/12

35 Why Remote Management Tools Are Important
Reduce time and make the job easier for the security administrator Reduce chance of configuration errors that might result if the same changes were made manually for each firewall on the network IS 3200, Summer 2010 7/12

36 Security Concerns Can use a Security Information Management (SIM) device to prevent unauthorized users from circumventing security systems Offers strong security controls (e.g., multi- factor authentication and encryption) Should have an auditing feature Should use tunneling to connect to the firewall or use certificates for authentication Evaluate SIM software to ensure it does not introduce new vulnerabilities IS 3200, Summer 2010 7/12

37 Basic Features of Remote Management Tools
Ability to monitor and configure firewalls from a single centralized location View and change firewall status View firewall’s current activity View any firewall event or alert messages Ability to start and stop firewalls as needed IS 3200, Summer 2010 7/12

38 Automating Security Checks
Outsource firewall management IS 3200, Summer 2010 7/12

39 Configuring Advanced Firewall Functions
Ultimate goal High availability Scalability Advanced firewall functions Data caching Redundancy Load balancing Content filtering IS 3200, Summer 2010 7/12

40 Data Caching Set up a server that will: Options
Receive requests for URLs Filter those requests against different criteria Options No caching URI Filtering Protocol (UFP) server VPN & Firewall (one request) VPN & Firewall (two requests) IS 3200, Summer 2010 7/12

41 Hot Standby Redundancy
Secondary or failover firewall is configured to take over traffic duties in case primary firewall fails Usually involves two firewalls; only one operates at any given time The two firewalls are connected in a heartbeat network IS 3200, Summer 2010 7/12

42 Hot Standby Redundancy (continued)
IS 3200, Summer 2010 7/12

43 Hot Standby Redundancy (continued)
Advantages Ease and economy of setup and quick backup system it provides for the network One firewall can be stopped for maintenance without stopping network traffic Disadvantages Does not improve network performance VPN connections may or may not be included in the failover system IS 3200, Summer 2010 7/12

44 Load Balancing Practice of balancing the load placed on the firewall so that it is handled by two or more firewall systems Load sharing Practice of configuring two or more firewalls to share the total traffic load Traffic between firewalls is distributed by routers using special routing protocols Open Shortest Path First (OSPF) Border Gateway Protocol (BGP) IS 3200, Summer 2010 7/12

45 Load Balancing (continued)
IS 3200, Summer 2010 7/12

46 Load Sharing Advantages Disadvantages
Improves total network performance Maintenance can be performed on one firewall without disrupting total network traffic Disadvantages Load usually distributed unevenly (can be remedied by using layer four switches) Configuration can be complex to administer IS 3200, Summer 2010 7/12

47 Filtering Content Firewalls don’t scan for viruses but can work with third-party applications to scan for viruses or other functions Open Platform for Security (OPSEC) model Content Vectoring Protocol (CVP) IS 3200, Summer 2010 7/12

48 Filtering Content (continued)
Install anti-virus software on SMTP gateway in addition to providing desktop anti-virus protection for each computer Choose an anti-virus gateway product that: Provides for content filtering Can be updated regularly to account for recent viruses Can scan the system in real time Has detailed logging capabilities IS 3200, Summer 2010 7/12

49 Chapter Summary After establishing a security policy, implement the strategies that policy specifies If primary goal of planned firewall is to block unauthorized access, you must emphasize restricting rather than enabling connectivity A firewall must be scalable so it can grow with the network it protects The stronger and more elaborate your firewall, the slower data transmissions are likely to be The more complex a network becomes, the more IP-addressing complications arise IS 3200, Summer 2010 7/12

50 Chapter Summary (continued)
Network security setups can become more complex when specific functions are added Firewalls must be maintained regularly to assure critical measures of success are kept within acceptable levels of performance Successful firewall management requires adherence to principles that have been put forth by reputable organizations to ensure that firewalls and network security configurations are maintained correctly IS 3200, Summer 2010 7/12

51 Chapter Summary (continued)
Remote management allows configuration and monitoring of one or more firewalls that are located at different network locations Ultimate goal for many organizations is the development of a high-performance firewall configuration that has high availability and that can be scaled as the organization grows; accomplished by using data caching, redundancy, load balancing, and content filtering IS 3200, Summer 2010 7/12

Download ppt "Chapter 8: Firewall Configuration and Administration"

Similar presentations

Network Security Essentials Chapter 11

Network Security Essentials Chapter 11
Firewalls By Tahaei Fall 2012. What is a firewall? a choke point of control and monitoring interconnects networks with differing trust imposes restrictions.

Firewalls By Tahaei Fall What is a firewall? a choke point of control and monitoring interconnects networks with differing trust imposes restrictions.
Guide to Network Defense and Countermeasures Second Edition

Guide to Network Defense and Countermeasures Second Edition
IUT– Network Security Course 1 Network Security Firewalls.

IUT– Network Security Course 1 Network Security Firewalls.
FIREWALLS Chapter 11.

FIREWALLS Chapter 11.
1 Chapter 8 Fundamentals of System Security. 2 Objectives In this chapter, you will: Understand the trade-offs among security, performance, and ease of.

1 Chapter 8 Fundamentals of System Security. 2 Objectives In this chapter, you will: Understand the trade-offs among security, performance, and ease of.
Setting Up a Virtual Private Network Chapter 9. Learning Objectives Understand the components and essential operations of virtual private networks (VPNs)

Setting Up a Virtual Private Network Chapter 9. Learning Objectives Understand the components and essential operations of virtual private networks (VPNs)
Information Security 1 Information Security: Security Tools Jeffy Mwakalinga.

Information Security 1 Information Security: Security Tools Jeffy Mwakalinga.
FIREWALLS. What is a Firewall? A firewall is hardware or software (or a combination of hardware and software) that monitors the transmission of packets.

FIREWALLS. What is a Firewall? A firewall is hardware or software (or a combination of hardware and software) that monitors the transmission of packets.
FIREWALLS The function of a strong position is to make the forces holding it practically unassailable —On War, Carl Von Clausewitz On the day that you.

FIREWALLS The function of a strong position is to make the forces holding it practically unassailable —On War, Carl Von Clausewitz On the day that you.
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 7 Working with Proxy Servers & Application-Level Firewalls By Whitman, Mattord,

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 7 Working with Proxy Servers & Application-Level Firewalls By Whitman, Mattord,
Working with Proxy Servers and Application-Level Firewalls Chapter 5.

Working with Proxy Servers and Application-Level Firewalls Chapter 5.
Network Security Topologies Chapter 11. Learning Objectives Explain network perimeter’s importance to an organization’s security policies Identify place.

Network Security Topologies Chapter 11. Learning Objectives Explain network perimeter’s importance to an organization’s security policies Identify place.
Building Your Own Firewall Chapter 10. Learning Objectives List and define the two categories of firewalls Explain why desktop firewalls are used Explain.

Building Your Own Firewall Chapter 10. Learning Objectives List and define the two categories of firewalls Explain why desktop firewalls are used Explain.
Firewall Configuration Strategies

Firewall Configuration Strategies
70-293: MCSE Guide to Planning a Microsoft Windows Server 2003 Network, Enhanced Chapter 11: Planning Network Access.

70-293: MCSE Guide to Planning a Microsoft Windows Server 2003 Network, Enhanced Chapter 11: Planning Network Access.
Firewall Planning and Design Chapter 1. Learning Objectives Understand the misconceptions about firewalls Realize that a firewall is dependent on an effective.

Firewall Planning and Design Chapter 1. Learning Objectives Understand the misconceptions about firewalls Realize that a firewall is dependent on an effective.
Chapter 12 Network Security.

Chapter 12 Network Security.
Guide to Network Defense and Countermeasures Third Edition

Guide to Network Defense and Countermeasures Third Edition
Firewall Configuration and Administration. 2 Learning Objectives Set up firewall rules that reflect an organization’s overall security approach Identify.

Firewall Configuration and Administration. 2 Learning Objectives Set up firewall rules that reflect an organization’s overall security approach Identify.

Similar presentations

Ads by Google