Firewalls - CompTIA Security+ SY0-701 - 4.5

Understanding Network-Based Firewalls

Overview of Network-Based Firewalls

• A network-based firewall is an inline appliance that decides whether to allow or disallow traffic based on port numbers or applications, distinguishing traditional firewalls from next-generation firewalls (NGFW).

Additional Functions of Firewalls

• Beyond security, firewalls can serve as VPN endpoints or concentrators, facilitating point-to-point connections and remote access VPN services.

Routing Capabilities

• Many firewalls also function as routers or layer 3 devices at the ingress/egress points of networks, enabling features like network address translation and dynamic routing.

Next-Generation Firewalls Explained

Features of Next-Generation Firewalls (NGFW)

• NGFWs analyze traffic to identify specific applications in use, allowing for more nuanced decisions about what traffic is permitted compared to traditional firewalls.

Advanced Traffic Analysis

• NGFWs are sometimes called application layer gateways or deep packet inspection devices due to their ability to perform detailed analysis beyond just port numbers.

Security Policies and Rule Bases

Structure of Firewall Rules

• A typical security policy in a next-gen firewall includes parameters such as rule name, source/destination IP addresses, user information, and application details.

Rule Evaluation Process

• Firewall rules are evaluated sequentially from top to bottom; specific rules are prioritized at the top while broader rules follow. An implicit deny policy means any unmatched traffic is automatically denied.

Access Control Lists (ACL)

Definition and Components of ACL

• An Access Control List (ACL) describes a set of rules governing network traffic based on various parameters including source/destination IP addresses and time constraints.

Example Firewall Rules

Understanding Specific Rules

Firewall Rules and Intrusion Prevention Systems

Overview of Firewall Rules

• Rule number four allows Microsoft Remote Desktop Protocol (RDP) traffic from any remote IP address to local port 3389 using TCP, permitting all such traffic.

• Rule number five permits DNS traffic by allowing all inbound traffic from a remote IP address on port 53 to any local port over UDP.

• Rule six enables Network Time Protocol (NTP) communication, allowing inbound traffic from any remote IP address on port 123 to any local port over UDP.

• An additional rule for ICMP is noted; since ICMP does not use TCP or UDP, if there’s inbound ICMP traffic that doesn't match existing rules, it is denied by the firewall.

• The firewall typically sits at the ingress/egress point of a network, separating internal networks from the internet.

Internal Network Structure

• The internal network contains confidential data while a screened subnet holds services accessible to internet users, enhancing security by isolating sensitive information.

• Traffic directed to the screened subnet prevents direct access to the internal network from external sources.

Intrusion Prevention Systems (IPS)

• IPS often integrates with next-generation firewalls and has its own specific rule base for monitoring real-time traffic and identifying malicious software through loaded signatures.

• An example of an IPS signature targets specific types of malicious traffic like that associated with the Conficker worm; matching signatures trigger actions based on predefined rules.

Signature-Based vs. Anomaly Detection

• Some IPS can operate without specific signatures by detecting anomalies indicative of intrusions, such as database injections, which are blocked even without a defined signature.

• The rule base in an IPS resembles that of a firewall but focuses on vulnerabilities; decisions can be made about whether these should be allowed or blocked.

Managing IPS Rules

• With thousands of signatures available in most IPS systems, administrators can summarize rules into groups for broader policy management regarding what is allowed or blocked.

• Customizing rules helps balance security needs against false positives; grouping related rules allows for efficient management and response strategies against threats.