If some elements of your policy can not be implemented with packet filters, then consider additional firewall mechanisms such as proxies. Why this is important Packet filtering can be a high performance, low cost means by which to implement a substantive portion of your network security policy. Intrinsic information is information that is contained within a packet itself. Some or all of this information may be referenced in filter rules depending on the actual implementation of the packet filter mechanism in the firewall software you have selected. Most packet filters only support references to information in headers.
Extrinsic information is information that exists outside of a packet.
Most packet filters are implemented as separate sets of rules for each interface, sometimes with separate sets for arriving and departing packets. By placing a given rule in the appropriate interface s rule set, you are using extrinsic information in the design of your rules. However, we recommend that you explicitly add this rule to remind you that this is the policy you are implementing and to express the rule set more completely. Design anti-spoofing rules and put them at the top of each rule set 2 . Canvass the potential users of this interconnect to find out what they expect to be doing.