-: One of the most common network security devices out there 2 2
is a firewall. 3 3
Now, we've talked about firewalls briefly up to this point, 4 4
but in this video, we're really going to dive deeper 5 5
into firewalls to really understand the type of firewalls 6 6
that are out there and how they operate. 7 7
Now, when we look at firewalls, they use a set of rules 8 8
to define the types of traffic that's going to be permitted 9 9
or denied through that device. 10 10
They basically act as a barrier to our networks, 11 11
these can be either software-based or hardware-based, 12 12
and they could be virtual or physical devices. 13 13
They can also be on the host or they can be on the network, 14 14
depending on if they're a host-based firewall 15 15
or a network-based firewall. 16 16
It really depends on your implementation, 17 17
but they're all going to work in pretty much the same way. 18 18
The other thing that a firewall can do for you, 19 19
especially a physical one that's sitting 20 20
at the edge of your network, 21 21
is to perform your Network Address Translation or NAT, 22 22
or if you're using Port Address Translation, PAT, 23 23
it can do that for you, too. 24 24
Now, that way, you can use one public IP 25 25
and many private IPs. 26 26
The first type of firewall we're going to talk about 27 27
is called a packet-filtering firewall. 28 28
These packet-filtering firewalls are going to permit 29 29
or deny traffic based on a packets header. 30 30
So, they have to access that packet and they have to look 31 31
at the header and look for the source or destination IP 32 32
and the source or destination port. 33 33
It's then going to to look at each of those packets individually 34 34
and make decisions whether to permit them or deny them 35 35
based on its access control list inside the firewall. 36 36
So, here on the screen, I have an access control list, 37 37
and this access control list has 100 deny ip any. 38 38
Now, what does that mean? 39 39
It means that any IP that is going to be denied 40 40
if it meets these rules, 100 is the line number, 41 41
deny as the action, ip is the protocol, 42 42
and any is the action against which it's going to take. 43 43
So, in this case, we have 44 44
an interface Fa one slash zero ip group 100 in, 45 45
and what's that saying is we're going to apply this 46 46
to any incoming traffic. 47 47
Now, in the case of this one, 48 48
if we have traffic coming in from the Internet, 49 49
like an HTTP reply, then it's going to get blocked 50 50
because nothing is allowed in 51 51
because we have a deny any statement here, 52 52
even though the request was able to go out 53 53
because that's outbound, anything coming back in 54 54
is going to be blocked because we have an inbound deny rule. 55 55
That's the bad thing about packet-filtering firewalls, 56 56
they work just based on the rule sets, 57 57
and so, if I have allow any going out, 58 58
but I would deny any coming in, 59 59
nothing's really going to work for us. 60 60
Now, this is because they're all based off the ACL, 61 61
and they're only based on the port or IP addresses. 62 62
In this case, we blocked any port on any IP 63 63
that's trying to make its way into our networks, 64 64
that wouldn't make it for a very effective firewall 65 65
if we want to be able to enable 66 66
any kind of two-way communications. 67 67
Now, the second type of firewall we have 68 68
is what's called a stateful firewall, 69 69
and they're going to inspect your traffic as part of a session. 70 70
So, let's take the example here on the screen. 71 71
If I'm sitting at PC1 and I make 72 72
an SSH connection out to the server on the Internet, 73 73
that is session one. 74 74
Now, the server can then reply to me with that SSH traffic 75 75
and the firewall is going to let it in, why? 76 76
Because I opened the firewall by making the request. 77 77
When I put the request out, it now expects a reply 78 78
to come back and it's going to forward that to me. 79 79
But if a second SSH server tried to come back 80 80
and create its own session, 81 81
the firewall is going to deny it, 82 82
that's because this firewall can keep track of the fact 83 83
that I made the initial request 84 84
and I'm only going to get an answer to my request, 85 85
anything else is going to be blocked. 86 86
Now, you could see how this is a lot more beneficial 87 87
than a packet-filtering firewall, 88 88
because it's going to go ahead and not just let anything 89 89
in or out, but it's going to keep track 90 90
of what's been requested and only let those things in. 91 91
With a packet-filtering firewall, I would have had 92 92
to let everything in for SSH or everything out, 93 93
it's either all or nothing. 94 94
But in this case, we can keep track of these sessions 95 95
and get a much more specific granularity of what's going to 96 96
be going on here and what's going to be allowed and denied. 97 97
This is what people are using when they're doing 98 98
a phishing attack to explore your networks, 99 99
because they know that most people 100 100
are using session-based firewalls, 101 101
and so, if I can send you an email and you click that link, 102 102
what you just did was request a session, 103 103
and that firewall is going to then open up the port 104 104
and letting that out 105 105
and let the reply back into your network, 106 106
and that's why they're trying to do that. 107 107
That is the bad thing about a stateful firewall. 108 108
If you have users who are doing the wrong things, 109 109
the firewall is going to let them through 110 110
because they're making those requests, 111 111
and since they requested it, 112 112
it's going to let the bad stuff come back in. 113 113
Now, we can combine the ACLs 114 114
and the permit and deny statements 115 115
of a packet-filtering firewall 116 116
with a stateful firewall's capabilities, 117 117
and this can give us a really good security device, 118 118
and most modern firewalls will support both of those things 119 119
and that's how they're going to work. 120 120
The next type of firewall we have 121 121
is known as a next-generation or next-gen firewall, 122 122
these are also abbreviated as NGFW. 123 123
Unlike stateful and stateless packet-filtering firewalls 124 124
that operate at layer four and below, 125 125
these third-generation firewalls can conduct 126 126
what's known as deep packet inspection or DPI. 127 127
This allows them to do full on packet-filtering. 128 128
They're going to operate in layers five, six, and seven 129 129
of the OSI model, where they can get 130 130
really in-depth information and understand 131 131
what those packets contain 132 132
and whether it's bad for our networks or not. 133 133
Now, these can also be referred 134 134
to as a web application firewall, 135 135
if they're specific to a web server 136 136
or more generally, they're just called next-gen firewalls. 137 137
If they're for your entire network, they're going to be 138 138
a great use to you, because they're going to inspect 139 139
all of the web traffic coming in and out 140 140
and really understand 141 141
what is going in and out of your network. 142 142
Then, they can dig in and choose to whether 143 143
allow it or deny it based on specific rule sets 144 144
that you give it. 145 145
When we talk about ACS or access control list, 146 146
what exactly are they? 147 147
Well, an ACL is simply a set of rules 148 148
that are typically assigned to a router interface 149 149
or a firewall and it's going to permit or deny certain traffic 150 150
based on its IP address, its MAC address, 151 151
or its port depending on what device you're dealing with. 152 152
If you're dealing with a switch, 153 153
it's going to be based off your MAC addresses. 154 154
If you're dealing with a router, 155 155
it's usually based off your IP addresses. 156 156
If you're dealing with a firewall, 157 157
it's going to based off your IP or your port. 158 158
Now, the ACLs are going to do this based on your source IP, 159 159
your destination IP, your source port, 160 160
your destination port, your source MAC, 161 161
or your destination MAC. 162 162
Now, you can choose any or all of these 163 163
to be the criteria you want based on your rule set. 164 164
So, here's an example on the screen, 165 165
I have three different access control list entries. 166 166
I have the first one, 167 167
which is going to permit or deny the first column. 168 168
Now, the protocol you're using, whether it's TCP or UDP, 169 169
is our second thing. 170 170
And the next column we have is our source IP, 171 171
and this can signify any or a specific IP 172 172
that we want or a range of IPs. 173 173
Then, we have a destination IP, and again, 174 174
this can be any IP, a specific client, 175 175
or an entire range depending on what you want. 176 176
Then, we have our destination port, 177 177
and then, we have things like WWW for port 80, 178 178
SSH for port 22, Telnet that for port 23, 179 179
you're getting the idea here, right? 180 180
We're going to be able to decide 181 181
what we're going to allow and what we're going to deny. 182 182
So, in our case, we have this group 183 183
on serial interface one slash zero 184 184
that's going to be allowed on the inbound direction. 185 185
We're going to apply these rules 186 186
which are going to permit port 80 web traffic to come in. 187 187
It's also going to permit SSH or port 22 to come in, as well, 188 188
but it's going to deny port 23 189 189
or Telnet traffic from coming in. 190 190
Now, this is the way you can deal with ACLs. 191 191
For your Network+ exam, you should be able to read 192 192
an ACL just like I did here on the screen, 193 193
but you don't need to come up with it by yourself 194 194
for the exam and be able to create your own ACLs. 195 195
Next, we have firewall zones. 196 196
All firewall interfaces are classified as a certain zone. 197 197
You can set up rules based on these zones 198 198
so that all the inside rules apply to these interfaces 199 199
and all the outside rules apply 200 200
to those interfaces over there. 201 201
Now, we have three zones we'd talk about, 202 202
we have inside, outside, and DMZ. 203 203
Now, inside is going to be your intranet, 204 204
it's your local area network. 205 205
It's connecting to your corporate local area network, 206 206
and anytime you talk about things outside of that, 207 207
you're going to be talking about things like the Internet 208 208
or external to your network. 209 209
Then, we have this other zone and it's known as the DMZ 210 210
or demilitarized zone. 211 211
It's going to connect devices 212 212
that should have some restricted access 213 213
from the outside zone, like web servers and email servers, 214 214
but they still aren't necessarily trusted 215 215
by your internal network. 216 216
It's kind of this in-between land, 217 217
between the trusted inside and the untrusted outside, 218 218
and it's really part of your network, 219 219
but it is segmented off as this demilitarized zone. 220 220
Now, what does this really look like? 221 221
Well, here's an example where I have three PCs 222 222
and a switch, and they're going to be able to tie 223 223
into this firewall and allow traffic 224 224
to go between certain zones. 225 225
Then, we have the DMZ, 226 226
where my email and my web server up at the top. 227 227
Then, I have this outside Internet zone over here. 228 228
Now, if I have the untrusted Internet, 229 229
am I going to allow traffic to go to my internal network 230 230
or my inside network? 231 231
Well, no, because I don't trust it. 232 232
The only way I'm going to do that 233 233
is if somebody has requested it, 234 234
like using a stateful firewall. 235 235
So, in general, we're going to block everything 236 236
going from the Internet to my internal zone. 237 237
Now, from my internal zone to my DMZ, again, 238 238
I don't really fully trust that DMZ, 239 239
so we're going to treat it like the Internet 240 240
from our internal network. 241 241
Now, if we request information from the email 242 242
or the web server, we'll get return traffic, 243 243
so that's going to be good for us. 244 244
But in general, we're going to block a lot of traffic 245 245
between those two zones. 246 246
Then, let's talk about the DMZ to the outside. 247 247
Well, the DMZ should always be able to go out 248 248
so they can request whatever they want 249 249
from the outside or from the Internet, 250 250
and we do have to allow certain things to come into the DMZ, 251 251
things like port 25 for sending an email 252 252
or port 110 for POP3, or port 143 for IMAP. 253 253
Those email type services need to be able 254 254
to have inbound traffic from the Internet 255 255
because that's what an email service is designed to do, 256 256
to serve those emails. 257 257
The same thing is true for the web server, 258 258
We're going to need to allow port 80 and port 443 259 259
for unsecured and secure web browsing 260 260
if we're going to host a web server, 261 261
because if we're running a web server, 262 262
people outside our network need to get to those web servers. 263 263
That's why the DMZ is considered 264 264
the semi-trusted zone, because people 265 265
from outside our networking reach in and touch the DMZ. 266 266
We wouldn't want them to reach and touch 267 267
our internal network, but we can get to those DMZ servers. 268 268
Now, we can really lock it down 269 269
and put a lot of protections in place, but we still have 270 270
to have some kind of open access to it because otherwise, 271 271
the email server and the web server 272 272
don't give us any functionality, right? 273 273
And so, that's the idea here with a DMZ, 274 274
it's a semi-trusted zone 275 275
between the inside and the outside network. 276 276
Now, the last type of device I want to mention here 277 277
is called a UTM or a unified threat management system. 278 278
Now, these have been getting a lot of popularity 279 279
in recent years, and this is a device 280 280
that's going to combine your firewall, your router, 281 281
your intrusion detection and intrusion prevention systems, 282 282
antimalware solutions you have, and other security devices, 283 283
all into a single device that's placed on your network. 284 284
This is generally considered a border device, 285 285
and it really is a next-generation next-generation firewall. 286 286
Now, there's an agent that's running your internal clients 287 287
and they can be queried by the UTM 288 288
before allowing any connection to the network. 289 289
They can also serve with a NAC or a network authentication 290 290
and network authorization function prior to allowing 291 291
any new devices onto your network, as well. 292 292
Now, these unified threat managers can be purchased 293 293
as a physical device to be installed in your networks 294 294
or there can be a virtualized device, 295 295
and there's even cloud solutions out there with UTMs, too. 296 296
If you're using a cloud solution, you'll just route 297 297
all your traffic to this cloud service provider 298 298
and they'll do all the security for you, 299 299
and then, they route your traffic out to the Internet, 300 300
because of this, UTMs are really expanding in popularity, 301 301
and you're going to see them more and more in networks 302 302
because they have this always on, always updated signatures 303 303
with the latest threat information 304 304
and the latest threat intelligence 305 305
that provides you additional security for your networks, 306 306
more so than a firewall alone could do for you.