Intro

In this lesson, we begin exploring network security components. This video looks specifically at the types of firewalls, how they're used, where they are placed, and how to use them to achieve network segmentation. We look at packet filtering firewalls. application layer firewalls, circuit-level firewalls, and stateful inspection firewalls. You can download the script for this video from above or at the end of the video.

Firewall Defined

One of the most important security safeguards is controlling traffic. If an unauthorized user or threat actor can't reach a resource, they can't compromise it. If a worm can't move from a small network space, it cannot infect the entire network and shut down all operations. We usually control traffic in two ways: layer 3 switches with VLANs and with firewalls. In this lesson, we focus on traffic control with firewalls.

Basic Firewall Operation

Firewalls establish boundaries. These boundaries can be at the overall network perimeter, or they can be between network segments. Organizations can implement firewalls with software, hardware, or both. In general, we set a firework firewall policy to block all traffic: both incoming or ingress, and outgoing or egress. Network admins then set filtering policies in each firewall that specify what packets and traffic behavior is allowed. The policies set on each firewall and what each firewall can filter depends on the type of firewall used. We look at firewall types and how they are used later in this lesson.

Firewall Log Management

In addition to using firewalls as a security safeguard, additional safeguards must protect the firewalls. One of the most important safeguards is log management and log review. Firewall logs can alert security that a threat actor is attempting bypass or has already done so. The CISSP common body of knowledge lists the following as things to look for in firewall logs. Firewall restarts, failure to start, crashes, changes to the configuration file, runtime configuration or system errors, unusual probes against the firewall, and unsuccessful logins.

Types of Firewalls

As I mentioned earlier, there are different types of firewalls. Boundary management capabilities differ across them. Well, there are differing firewall descriptions, especially when vendors try to differentiate their products. The CISSP common body of knowledge defines four different types of firewalls: static packet filtering, application layer, circuit-level, and stateful inspection.

Static Packet Inspection Firewall

Let's look at each. The first type of firewall used on networks was the static packet inspection firewall, a generation 1 firewall. They are still used when they are more appropriate than another type, and this functionality is included in other firewall types. This firewall operates at OSI layer 3. It can quickly look at each packet to determine whether it is allowed to pass. It does this by looking at the source IP address, the destination IP address, ports used, and service protocols. In this example, the network admin only wants to allow traffic to the database server from the application server. Each is on its own subnet. Note that this is not a network perimeter application of a firewall. Rather, this firewall is placed on the same VLAN, or network segment, with the database server to provide another layer of protection. The firewall is configured to block all traffic that's not explicitly allowed, so the admin creates this rule. This is not a view of any vendor-specific configuration instructions; it's just an example. In this example, the firewall will look at both the source and destination IP addresses to determine if the packet is allowed to pass through. Also, note that the destination IP address in the first address set has the number 1433 following the IP address. This is a common port number used to access Microsoft SQL Server database services. If a packet source and destination address does not match this rule, including any defined ports, the firewall will block it. This is a very simple approach to boundary control, and it is not usually enough for perimeter control or for more specific applications. Disadvantages of this speedy firewall approach include susceptibility to denial of service and overflow attacks.

Application-layer Firewall

An application-layer firewall operates largely at layer 7 but can also perform tasks at layers t3 through 6. Also known as a proxy firewall, it's a generation 2 device. In general, they can offload session encryption from a web server, detect and prevent intrusion attempts, and help prevent passage of sensitive information. Application layer firewalls can be active or passive. Active firewalls inspect all incoming client requests to detect SQL injections, parameter and cookie tampering, and cross-site scripting. If a threat is detected, the malicious traffic is blocked. Passive firewalls work like IDS devices, comparing all incoming traffic to known threats, but they don't actually drop any packets. They simply log the event and possibly send alerts. Network-based application firewalls, or gateways, operate at the application layer. They usually understand application layer protocols like FTP, DNS, and HTTP. This enables security teams to create firewall rules that can block protocol abuse and data extrusion. It can also offload session encryption from the servers it protects. Another type of application firewall is host-based. Host-based application firewalls run on endpoints instead of on network firewall appliances. They protect the host on which they run from establishing sessions not explicitly approved. Application layer firewalls are the slowest form of firewall.

Circuit-level Firewall

The circuit-level firewall, also a generation 2 firewall, only operates at OSI layer 6. The only thing it does is ensure that TCP handshakes are completed. It also verifies the sequencing of session packets.

Stateful Inspection Firewall

The stateful inspection firewall, a gen 3 firewall, operates at OSI layers 3 and 4. In addition to performing the packet inspection tasks associated with the stateful packet inspection firewall, it also looks at session activity to identify malicious activities, suspicious commands, and questionable session activity patterns. Selection of the right stateful inspection firewall size is important because it can take significant processing power to perform all these tasks without slowing traffic.

Next-gen Firewall

Next-gen firewalls, or NGFW, combine the features of all the firewalls already discussed. In most cases, they add capabilities not associated with a firewall: including an IPS and the use of external threat intelligence. Some vendors also add web filtering and VPN endpoint capabilities to next-gen firewall devices.

Multi-home Firewall

Two special-purpose firewall implementations include multi-homed firewalls and bastion, or screen, hosts. The multi-home firewall label is a general term for firewall or proxy capabilities. This type of firewall has more than two ports that enable the application of traffic policies to multiple network segments. In other words, these firewalls can be used to segment networks instead of using layer 3 switches. We see how this works later in this lesson.

Bastion Host

A bastion host is a special purpose firewall or a host computer placed behind a router, DMZ, or layer 3 switch. It separates traffic coming from outside the network or network segment from the network or segment resources. In other words, they act as a proxy. Bastion hosts are usually restricted to no more than one function, including access to DNS services, email, FTP, or websites. A bastion host can also be a VPN endpoint at which remote users securely access data intranet resources.

Segmentation with Firewalls

As I mentioned earlier, firewalls are used for more than perimeter security. Efforts to segment networks and achieve zero trust networking often rely on the placement of firewalls. This is especially true of multi-homed firewalls. For example, a generation 3 firewall can sit at the perimeter border. A multi-home firewall can both protect the internal network and control which internal network segment the external traffic can access based on defined policies. This example is known as a two-tiered approach. For larger organizations, three or more tiers are needed. In this example, multi-homed firewalls and two-port firewalls are implemented to achieve microsegmentation. Yes, a layer 3 switch can do this, but firewalls are considered more secure. Switches are susceptible to known attacks that circumvent VLAN access controls. That's it for this lesson. If you have questions, please ask. ...and until next time be careful what you click.