Network Defense and

Countermeasures
Sir. Ahmad Kamalrulzaman Othman
FSKM, UiTM Johor

Chapter 4: Firewall Practical Applications

Objectives

Explain the requirements of firewalls for:

Single machine
Small office
Network and enterprise

Evaluate the needs and constraints of an

individual or company to determine an
appropriate firewall solution

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

Objectives cont.

Compare popular firewall solutions

Recommend an appropriate firewall solution
for a given situation

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

Introduction
This chapter examines the practical
requirements of the most common firewall
solutions. Firewall solutions discussed in this
chapter focus on the specific situation that they
will be implemented in, not on whether they are
the best or most secure solution.

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

Single Machine Firewalls

Used on PCs in a home office or individual

workstations on a network
Commonality of single machine firewalls:

Packet filtering or screening firewalls

All are software based
Most are easy to configure and set up

Helpful as a supporting role for network

security, not a primary solution

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

Single Machine Firewalls (SMF) cont.

Target market: home user

Assumptions of these firewalls:

Ease of use
Low cost or even free download
Meant for essential security not high security

SMFs include:

Windows XP, Linux

Commercial firewalls

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

Single Machine Firewalls (SMF) cont.

Windows XP

Ships with Internet Connection Firewall (ICF)

Enabled by default with SP2
Simple to set up and use
Figure 4.1 in student text shows a sample screen

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

Single Machine Firewalls (SMF) cont.

Windows XP (Continued)

Advantages:

Come with OS, no extra cost

Easy to set up
Enabled by default with SP2
Logging features, blocks ICMP packets

Disadvantages:

Does not block outbound traffic

Uses only packet filtering

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

Single Machine Firewalls (SMF) cont.

Symantic Norton Firewall

Basic packet filtering

Included with Norton antivirus software
Ability to block outbound traffic (significant)

Can block an infected machine from propagating virus

Blocks ports that Trojan Horse might communicate on

Supports ad/popup blocking

Can scan your machine through Norton web site

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

Single Machine Firewalls (SMF) cont.

Symantic Norton Firewall (Continued)

Advantages:

Can be purchased as a bundle with Antivirus software

Easy to set up
Extra features scan system from web site
Blocks outbound traffic

Disadvantages:

Costs almost $50 per copy

Many additional features separate tools (free)

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

10

Single Machine Firewalls (SMF) cont.

McAfee Personal Firewall

Advantages:

Blocks outbound/inbound traffic

Easy to set up
Links to anti-hacking news and tips

Disadvantages:

Cost is $30 - $50 depending on version

Extra features can be obtained without this product

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

11

Single Machine Firewalls (SMF) cont.

Wolverine

Solution for Linux

Advantages:

Low cost, most expensive is less than $200

Built-in VPN capabilities
Built-in encryption
Web-based administration

Disadvantages:

Most organizations are Windows-based

Network host-based, dependent on OS

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

12

Small Office Home Office (SOHO)

Administration personnel have some security

training
Norton and McAfee offer solutions at slightly
higher costs than personal firewalls
Other solutions:

SonicWALL
D-Link DFL-300 Office Firewall

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

13

Small Office Home Office (SOHO)

cont.

SonicWALL

Advantages:

Provides stateful packet inspection

Built-in encryption
Easy management/administration for Windows
administrators
Built-in Network Address Translation (NAT)

Disadvantages:

Cost $350 - $700 (might be prohibitive for SOHO)

Requires some skill, not intended for complete novice

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

14

Small Office Home Office (SOHO)

cont.

D-Link DFL-300 Office Firewall

Has a web-based interface, like home wireless

routers
Cost between $350 - $500
Does not require additional licenses when adding
users

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

15

Small Office Home Office (SOHO)

cont.

D-Link DFL-300 Office Firewall

Advantages:

Built-in reliable encryption

Inexpensive compared to other SOHO firewalls
Liberal licensing policy
Easy to configure
Stateful packet inspection
Built-in NAT and VPN

Disadvantages:

Lacks some security features offered by other solutions

Combines multiple firewall types

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

16

Medium-Sized Network Firewalls

Defined as 25 users to several hundred users

at single location
Often have dedicated network administration
personnel
Solutions:

Check Point Firewall-1

Cisco PIX 515E

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

17

Medium-Sized Network Firewalls

cont.

Check Point Firewall-1

Hybrid between packet filtering and application

gateway
Capable of protecting against SYN and oversized
packets automatically
Cost is anywhere between $3,000 and $50,000

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

18

Medium-Sized Network Firewalls

cont.

Check Point Firewall-1 (Continued)

Advantages:

Works with multiple operating systems (Windows,

Solaris, Linux)
Combines SPI and application gateway
Protects against common DoS attacks

Disadvantages:

Dependent on security of OS
Requires moderate skill to configure and administer
Cost may be prohibitive

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

19

Medium-Sized Network Firewalls

cont.

Cisco PIX 515E

Advantages:

Uses SPI filtering

Built-in robust encryption
Cisco product-specific training is available
Includes NAT
Includes VoIP and multimedia security options

Disadvantages:

Cost (between $1,800 and $2,600) may be prohibitive

Requires moderate skills to configure and administer

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

20

Enterprise Firewalls

Network that typically includes a WAN

connection
Extremely complex security situation
Dedicated team of administrators included
security professionals
Solution:

Fortigate 3600

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

21

Enterprise Firewalls cont.

Fortigate 3600

Advantages:

Offers SPI and user authentication

Built-in IDS and virus scanning
24-hour update service
Built-in robust encryption
Very extensive content filtering

Disadvantages:

Requires trained personnel to administer

Cost = $20,000 with annual service contracts with
additional cost in the thousands of dollars

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

22

Summary

The appropriate firewall solution corresponds in

large part to the size of a network
There are various solutions on the market that
can accommodate different size networks
Single machine or personal firewalls are cost
effective and easy to set up and administer
Small Office Home Office (SOHO) have
affordable solutions that typically are easy to set
up and administer with minimal knowledge

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

23

Summary cont.

Medium and enterprise network solutions

require more knowledge specific to firewall
configuration and administration
Popular firewall solutions have been
presented for each size of network:

Norton, McAfee, Windows XP, and Wolverine

SonicWALL and D-Link
Check Point and Cisco PIX
Fortigate

2006 by Pearson Education, Inc.

Chapter 4 Firewall Practical Applications

24