1. Firewalls Types of Firewalls Inspection Methods Firewall Architecture
Configuring, Testing, and Maintenance

2. Figure 5-22: Configuring, Testing, and Maintaining Firewalls
Firewall Misconfiguration is a Serious Problem
ACL rules must be executed in series
Easy to make misordering problems
Easy to make syntax errors

3. Figure 5-22: Configuring, Testing, and Maintaining Firewalls
Create Policies Before ACLs
Policies are easier to read than ACLs
Can be reviewed by others more easily than ACLs
Policies drive ACL development
Policies also drive testing

4. Figure 5-22: Configuring, Testing, and Maintaining Firewalls
Must test Firewalls with Security Audits
Only way to tell if policies are being supported
Must be driven by policies
Maintaining Firewalls
New threats appear constantly
ACLs must be updated constantly if firewall is to be effective

5. Figure 5-23: FireWall-1 Modular Management Architecture
Log Files
Policy
Policy
Firewall Module Enforces Policy Sends Log Entries
Application Module (GUI) Create, Edit Policies
Management Module Stores Policies Stores Log Files
Log File Entry
Log File Data
Firewall Module Enforces Policy Sends Log Entries
Application Module (GUI) Read Log Files

6. Figure 5-24: FireWall-1 Service Architecture
2. Statefully Filtered Packet
1. Arriving Packet
3. DoS Protection Optional Authentications
Internal Client
External Server
FireWall-1 Firewall
4. Content Vectoring Protocol
Statefully Filtered Packet Plus Application Inspection
Third-Party Application Inspection Firewall

7. Figure 5-25: Security Level-Based Stateful Filtering in PIX Firewalls
Automatically Accept Connection
Internet
Security Level Inside=100
Security Level Outside=0
Router
Automatically Reject Connection
Internal Network
Security Level=60
Connections Are Allowed from More Secure Networks to Less Secure Networks

8. Figure 5-21: Other Security Architecture Issues
Host and Application Security (Chapters 6 and 9)
Antivirus Protection (Chapter 4)
Intrusion Detection Systems (Chapter 10)
Virtual Private Networks (Chapter 8)
Policy Enforcement System