ProVision IT Security

A firewall is a system or group of systems that enforces an access control policy between two networks. It gives an administrator the power to deny unknown or unwanted traffic and permit only the traffic needed by the company or end users. The actual means by which this traffic policy enforcement is accomplished varies widely from product to product but in general firewalls fall under one of the following types: packet filtering firewalls, proxy servers, application gateways and stateful inspection firewalls.

Types of firewall

Packet Filtering Firewalls

This type of firewall focuses on detecting "packets" and blocks all but selected network traffic. It is typically limited in functionality to filtering; thus you may not receive information as to the origin of the communications, internal users, time and file sizes transmitted and other statistical information.

Proxy Servers

Proxy Servers allow indirect access to and from the Internet by breaking the client/server model. Thus every client/server communication will require two connections, one from the client to the firewall (which acts as a "proxy" for the desired server, and one from the firewall to the desired server). This system has the advantage of being able to provide detailed information, but scalability can be an issue.

Application Gateway

An Application Gateway provides the highest level of security possible and provides full application layer awareness without interposing a proxy server. It works by extracting the state-related information required for security decisions from all application layers and maintains this information in dynamic state tables for evaluating subsequent connection attempts. This provides a solution that is highly secure, offering high performance and scalability.

Stateful Inspection

The firewall comes with a default security policy which blocks all "inbound" connections (from the Internet to the LAN), and allows all "outbound" connections (from the LAN to the Internet). The desired effect is that LAN users can continue to access Internet resources, while hackers on the Internet cannot access the internal LAN resources. Since user-level applications such as FTP and the Web can create complex patterns of network traffic, it is necessary for the appliance to analyze groups of network connection "states". A central cache within the firewall appliance keeps track of the state information associated with all network connections. All traffic passing through the firewall is analyzed against the state of these connections in order to determine whether or not it will be allowed to pass through or rejected.