Table Of ContentFirewall Fundamentals
Wes Noonan
Ido Dubrawsky
Cisco Press
800 East 96th Street
Indianapolis, Indiana 46240 USA
ii
Firewall Fundamentals
Wes Noonan
Ido Dubrawsky
Copyright © 2006 Cisco Systems, Inc.
Published by:
Cisco Press
800 East 96th Street
Indianapolis, IN 46240 USA
All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical,
including photocopying, recording, or by any information storage and retrieval system, without written permission from the pub-
lisher, except for the inclusion of brief quotations in a review.
Printed in the United States of America 1 2 3 4 5 6 7 8 9 0
First Printing June 2006
Library of Congress Cataloging-in-Publication Number: 2004114308
ISBN: 1-58705-221-0
Trademark Acknowledgments
All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Cisco Press
or Cisco Systems, Inc. cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting
the validity of any trademark or service mark.
Warning and Disclaimer
This book is designed to provide information about firewalls. Every effort has been made to make this book as complete and as accu-
rate as possible, but no warranty or fitness is implied.
The information is provided on an “as is” basis. The authors, Cisco Press, and Cisco Systems, Inc. shall have neither liability nor
responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from
the use of the discs or programs that may accompany it.
The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc.
Corporate and Government Sales
Cisco Press offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales. For more informa-
tion, please contact: U.S. Corporate and Government Sales 1-800-382-3419 [email protected]
For sales outside of the U.S. please contact: International Sales 1-317-581-3793 [email protected]
Feedback Information
At Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each book is crafted with care and pre-
cision, undergoing rigorous development that involves the unique expertise of members from the professional technical community.
Readers’ feedback is a natural continuation of this process. If you have any comments regarding how we could improve the quality
of this book, or otherwise alter it to better suit your needs, you can contact us through email at [email protected]. Please
make sure to include the book title and ISBN in your message.
We greatly appreciate your assistance.
iii
Editor-in-Chief Paul Boger
Cisco Representative Anthony Wolfenden
Cisco Press Program Manager Jeff Brady
Executive Editor Brett Bartow
Production Manager Patrick Kanouse
Development Editor Andrew Cupp
Project Editor Interactive Composition Corporation
Copy Editor Interactive Composition Corporation
Technical Editors Randy Ivener, Eric Seagren
Editorial Assistant Raina Han
Book and Cover Designer Louisa Adair
Composition Interactive Composition Corporation
Indexer Tim Wright
iv
About the Authors
Wes Noonan,CISA, is a staff quality engineer at NetIQ working on their security solutions
product line. Wes has more than 12 years of industry experience, specializing in Windows-based
networks and network infrastructure security design and implementation. Wes is the author of
Hardening Network Infrastructure (ISBN 0072255021),is a contributing/co-author of CISSP
Training Guide (ISBN 078972801X)andHardening Network Security (ISBN 0072257032), and
is a technical editor for Hacking Exposed: Cisco Networks (ISBN 0072259175). Wes also
maintains a Windows network security “Ask the Experts” section for Techtarget.com (http://
searchwindowssecurity.techtarget.com/ateAnswers/0,289620,sid45_tax298206,00.html). Wes
lives in the Houston, Texas, metropolitan area with his wife and two bulldogs.
Ido Dubrawsky, CISSP, is the strategic security advisor for the Communications Sector at
Microsoft. Prior to working at Microsoft, Ido was the owner and president of Silicon Security, Inc.
(http://www.siliconsec.com), a mid-Atlantic network security consulting company, as well as the
acting national practice lead for the security consulting practice at AT&T/Callisma. Before joining
AT&T/Callisma, Ido worked for more than four years at Cisco Systems, Inc., as both a network
security engineer as well as a network security architect on the SAFE project.
About the Technical Reviewers
Randy Ivener,CCIE No. 10722, is a security specialist with the Cisco Systems product security
incident response team. He is a CISSP and ASQ CSQE. Randy has spent many years as a network
security consultant helping companies understand and secure their networks. Before becoming
immersed in information security, he spent time in software development and as a training
instructor. Randy graduated from the U.S. Naval Academy and holds a master’s degree in business
administration.
Eric S. Seagren,CISA, CISSP-ISSAP, SCNP, CCNA, MCP+I, MCSE, and CNE, has nine years
of experience in the computer industry, with the past seven years spent in the financial services
industry working for a Fortune 100 company. Eric started his computer career working on Novell
servers and performing general network troubleshooting for a small Houston-based company.
While working in the financial services industry, his duties have included server administration,
disaster recovery responsibilities, business continuity coordinator, Y2K remediation, and network
vulnerability assessment responsibilities. He has spent the past few years as an IT architect and
risk analyst, designing and evaluating secure, scalable, and redundant networks. Eric lives in
Missouri City, Texas.
v
Dedications
For SSgt. Anthony L. Goodwin, USMC. KIA 05/08/05. Semper Fidelis, my friend—you will not
be forgotten.
vi
Acknowledgments
From Wes:
I’d like to thank my wife for once again sacrificing the time it took me to work on another book.
I couldn’t do this without you.
I could not have done this had Brian Ford not been willing to take a chance on bringing me in on
this project. Likewise, I appreciate the chance to work with Ido Dubrawsky and look forward to
future partnerships. I want to thank both Brian and Ido for the opportunity and privilege of
working with them both. To Brett Bartow and Andrew Cupp, I know we drove you crazy from time
to time, but thanks for being patient and sticking with us and providing the guidance and
encouragement we needed to finish this project.
Thank you to my colleagues both at Collective Technologies and NetIQ for giving me the
opportunity to mature and grow as an engineer and a person. To Jeff Pollard for giving me the time
I needed to finish this project, everyone should be so lucky as to work for a boss like you. I’d also
like to thank Geri Williams for providing technical expertise on the late nights of writing. I’d be
remiss if I didn’t thank the technical and copy editors for helping to ensure not only the technical
accuracy of what I wrote, but for making me sound far more intelligent than I am by making it
appear that I have a much better grasp of English and the written word than I do!
Finally, thank you to my family and friends for all of their support and encouragement. Roll 20s
and Semper Fidelis.
From Ido:
I would like to thank, first and foremost, my wife, whom I dearly love and treasure and without
whom I would not be where I am today. Second, I wish to give my thanks to my wonderful
children, who are truly the light of my life. I took time away from my family to write this
book, and there were moments where I wished to be there more for them but could not be.
I love all of you with all of my heart. May G-d bless you all and keep you. May G-d shine his
countenance upon you all and be gracious to you. May G-d lift his countenance to you all
and bring you peace.
I wish to also thank Wes Noonan for agreeing to work on this project as a great co-author and to
thank Brett Bartow for being as patient an editor as he has been. My schedule notwithstanding,
this has been a trial for both of them, too. Thanks also to Brian Ford for bringing me in on this
project and for listening to me when I was frustrated with it.
vii
To my good friend Ben Bazian who has been a source of humor and good counsel when I needed
it I wish to give a very big thank you. A big thanks also goes to Nigel Willson for being a great
national director for the Security Consulting Practice over at AT&T. I also want to thank Ricardo
Farraj-Ruiz, Charles Outlaw, and Karl Weaver over at CRS in the Library of Congress for being
great people to work with. And last but certainly not least, thanks to David Barak and Peter Griffin
over at AT&T/Callisma. David has amazed me with his vast knowledge of service provider
routing, and Peter has immense knowledge in the optical world and in that strange world that is
Callisma management.
viii
This Book Is Safari Enabled
The Safari® Enabled icon on the cover of your favorite technology book
means the book is available through Safari Bookshelf. When you buy this
book, you get free access to the online edition for 45 days.
Safari Bookshelf is an electronic reference library that lets you easily
search thousands of technical books, find code samples, download chap-
ters, and access technical information whenever and wherever you need it.
To gain 45-day Safari Enabled access to this book:
■ Go to http://www.ciscopress.com/safarienabled
■ Complete the brief registration form.
■ Enter the coupon code UZGR-WUPF-DQ5Z-ITFF-DXJT
If you have difficulty registering on Safari Bookshelf or accessing the online
edition, please e-mail [email protected].
ix
Contents at a Glance
Introduction xxii
Part I Introduction to Firewalls 3
Chapter 1 Introduction to Firewalls 5
Chapter 2 Firewall Basics 27
Chapter 3 TCP/IP for Firewalls 43
Part II How Firewalls Work 85
Chapter 4 Personal Firewalls: Windows Firewall and Trend Micro’s PC-cillin 87
Chapter 5 Broadband Routers and Firewalls 107
Chapter 6 Cisco PIX Firewall and ASA Security Appliance 125
Chapter 7 Linux-Based Firewalls 161
Chapter 8 Application Proxy Firewalls 177
Chapter 9 Where Firewalls Fit in a Network 209
Part III Managing and Maintaining Firewalls 227
Chapter 10 Firewall Security Policies 229
Chapter 11 Managing Firewalls 253
Chapter 12 What Is My Firewall Telling Me? 277
Chapter 13 Troubleshooting Firewalls 301
Chapter 14 Going Beyond Basic Firewall Features 323
Part IV Appendixes 339
Appendix A Firewall and Security Tools 341
Appendix B Firewall and Security Resources 359
Index 364
