Firewalls: Jumpstart for Network and Systems Administrators

449 Pages·2.051 MB·English

by  John R. Vacca, Scott Raymond Ellis

Firewalls
Jumpstart for
Network and Systems
Administrators

Firewalls
Jumpstart for
Network and Systems
Administrators
John R.Vacca
Scott Ellis
AMSTERDAM • BOSTON • HEIDELBERG • LONDON
NEW YORK • OXFORD • PARIS • SAN DIEGO
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Elsevier Digital Press
200 Wheeler Road, 6th Floor, Burlington, MA 01803, USA
525 B Street, Suite 1900, San Diego, California 92101-4495, USA
84 Theobald’s Road, London WC1X 8RR, UK
This book is printed on acid-free paper.
Copyright © 2005, Elsevier Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopy, recording, or any information storage and
retrieval system, without permission in writing from the publisher.
Permissions may be sought directly from Elsevier’s Science & Technology Rights Department
in Oxford, UK: phone: [phone], fax: [phone],
e-mail: [email protected]. You may also complete your request on-line via the
Elsevier homepage (http://elsevier.com), by selecting “Customer Support”
and then “Obtaining Permissions.”
Library of Congress Cataloging-in-Publication Data
Application submitted
British Library Cataloguing in Publication Data
A catalogue record for this book is available from the British Library
ISBN: 1-55558-297-4
For all information on all Digital Press publications
visit our Web site at www.digitalpress.com
Printed in the United States of America
04 05 06 07 08 09 9 8 7 6 5 4 3 2 1
To my beloved wife Bee, without whose support
and encouragement this book would not have been possible.
—John R. Vacca
For Elaine. Her patience, her enduring love,
her sacrifice, and her quiet determination
have rendered the man I am today.
I am forever in her debt.
Without her, this and so much more would not have been possible.
—Scott Ellis
This Page Intentionally Left Blank
Contents
Foreword xvii
Introduction xix
Acknowledgments xxix
Section I—Overview of Firewall Technology 1
1 Firewalls: What Are They? 3
1.1 Chapter objectives 3
1.2 Firewall defined 7
1.3 Why firewalls? 8
1.3.1 The need for firewalls 9
1.4 Benefits of firewalls 12
1.4.1 Protection from vulnerable services 13
1.4.2 Controlled access to site systems 13
1.4.3 Concentrated security 14
1.5 Enhanced privacy 15
1.5.1 Logging and statistics on network use and misuse 15
1.5.2 Policy enforcement 15
1.6 Limitations of firewalls 16
1.6.1 What about viruses? 18
1.7 Summary 19
1.8 References 21
2 Type of Firewall Security Policy 23
2.1 Chapter objectives 23
2.2 Firewall protection 24
vii
viii Contents
2.3 Firewall architectures 25
2.3.1 Multi-homed host 25
2.3.2 Screened host 26
2.3.3 Screened subnet 26
2.4 Types of firewalls 26
2.4.1 Packet-filtering gateways 27
2.4.2 Application gateways 28
2.4.3 Hybrid or complex gateways 29
2.5 Issues 29
2.5.1 Authentication 30
2.5.2 Routing versus forwarding 30
2.5.3 Source routing 30
2.5.4 IP spoofing 31
2.5.5 DNS and mail resolution 31
2.6 Intranet 32
2.7 Network trust relationships 33
2.7.1 High 33
2.7.2 Low to medium 33
2.8 Virtual private networks 34
2.9 Firewall administration 34
2.9.1 Qualification of the firewall administrator 35
2.9.2 Remote firewall administration 35
2.9.3 User accounts 36
2.9.4 Firewall backup 37
2.9.5 System integrity 37
2.9.6 Documentation 38
2.9.7 Physical firewall security 38
2.9.8 Firewall incident handling 39
2.9.9 Restoration of services 39
2.9.10 Upgrading the firewall 40
2.9.11 Logs and audit trails:audit/event reporting and summaries 40
2.10 Revision/update of firewall policy 41
2.11 Examples of service-specific policies 44
2.12 Summary 48
2.13 References 48
3 Firewall Types 49
3.1 Chapter objectives 49
3.2 Types of firewalls 50
3.2.1 Simple packet filtering:IP or filtering firewalls 50
Contents ix
3.2.2 Application-layer firewalls:proxy servers 53
3.2.3 Stateful multilayer-inspection firewalls 54
3.3 Understanding firewall types 55
3.4 Firewall types drawbacks 55
3.5 Summary 56
3.6 References 57
Section II—Firewall Topologies 59
4 Choosing the Right Firewall 61
4.1 Chapter objectives 61
4.2 Convergence 63
4.2.1 The criminal meagermind 63
4.2.2 Considerations 65
4.2.3 Products 70
4.3 About packet inspection 72
4.3.1 Selecting a firewall 72
4.3.2 Firewall solutions 75
4.4 Summary 90
5 Defense in Depth: Firewall Topologies 93
5.1 Chapter objectives 93
5.2 Virtual private network 94
5.2.1 Remote office VPN 96
5.2.2 Remote user VPN 96
5.2.3 Point-to-point tunneling protocol VPN 97
5.2.4 Authenticating with a remote access dial-in user 97
service server
5.3 Firewall policies 97
5.3.1 How secure is VPN technology? 98
5.3.2 Document access 99
5.4 Setting up a demilitarized zone:A VPN alternative? 100
5.4.1 Uses 100
5.4.2 Theory of operation 100
5.4.3 Managing ports in a DMZ 103
5.4.4 DMZ topology 106
5.5 Summary 110
Contents