1 1 00:00:00,780 --> 00:00:03,410 One of the most common network security devices out there 2 2 00:00:03,410 --> 00:00:05,000 is a firewall. 3 3 00:00:05,000 --> 00:00:07,500 Now, we've talked about firewalls briefly up to this point, 4 4 00:00:07,500 --> 00:00:10,010 but in this video, we're really going to dive deeper 5 5 00:00:10,010 --> 00:00:12,480 into firewalls to really understand the type of firewalls 6 6 00:00:12,480 --> 00:00:14,720 that are out there and how they operate. 7 7 00:00:14,720 --> 00:00:17,470 Now, when we look at firewalls, they use a set of rules 8 8 00:00:17,470 --> 00:00:19,950 to define the types of traffic that's going to be permitted 9 9 00:00:19,950 --> 00:00:21,990 or denied through that device. 10 10 00:00:21,990 --> 00:00:24,470 They basically act as a barrier to our networks, 11 11 00:00:24,470 --> 00:00:27,150 these can be either software-based or hardware-based, 12 12 00:00:27,150 --> 00:00:29,730 and they could be virtual or physical devices. 13 13 00:00:29,730 --> 00:00:32,780 They can also be on the host or they can be on the network, 14 14 00:00:32,780 --> 00:00:34,330 depending on if they're a host-based firewall 15 15 00:00:34,330 --> 00:00:35,990 or a network-based firewall. 16 16 00:00:35,990 --> 00:00:38,240 It really depends on your implementation, 17 17 00:00:38,240 --> 00:00:41,190 but they're all going to work in pretty much the same way. 18 18 00:00:41,190 --> 00:00:43,000 The other thing that a firewall can do for you, 19 19 00:00:43,000 --> 00:00:44,570 especially a physical one that's sitting 20 20 00:00:44,570 --> 00:00:45,910 at the edge of your network, 21 21 00:00:45,910 --> 00:00:49,350 is to perform your Network Address Translation or NAT, 22 22 00:00:49,350 --> 00:00:52,010 or if you're using Port Address Translation, PAT, 23 23 00:00:52,010 --> 00:00:53,700 it can do that for you, too. 24 24 00:00:53,700 --> 00:00:56,290 Now, that way, you can use one public IP 25 25 00:00:56,290 --> 00:00:58,270 and many private IPs. 26 26 00:00:58,270 --> 00:01:00,260 The first type of firewall we're going to talk about 27 27 00:01:00,260 --> 00:01:02,700 is called a packet-filtering firewall. 28 28 00:01:02,700 --> 00:01:05,030 These packet-filtering firewalls are going to permit 29 29 00:01:05,030 --> 00:01:07,770 or deny traffic based on a packets header. 30 30 00:01:07,770 --> 00:01:10,490 So, they have to access that packet and they have to look 31 31 00:01:10,490 --> 00:01:12,920 at the header and look for the source or destination IP 32 32 00:01:12,920 --> 00:01:15,070 and the source or destination port. 33 33 00:01:15,070 --> 00:01:17,500 It's then going to to look at each of those packets individually 34 34 00:01:17,500 --> 00:01:20,380 and make decisions whether to permit them or deny them 35 35 00:01:20,380 --> 00:01:23,520 based on its access control list inside the firewall. 36 36 00:01:23,520 --> 00:01:26,280 So, here on the screen, I have an access control list, 37 37 00:01:26,280 --> 00:01:30,400 and this access control list has 100 deny ip any. 38 38 00:01:30,400 --> 00:01:31,930 Now, what does that mean? 39 39 00:01:31,930 --> 00:01:34,500 It means that any IP that is going to be denied 40 40 00:01:34,500 --> 00:01:37,510 if it meets these rules, 100 is the line number, 41 41 00:01:37,510 --> 00:01:40,280 deny as the action, ip is the protocol, 42 42 00:01:40,280 --> 00:01:43,220 and any is the action against which it's going to take. 43 43 00:01:43,220 --> 00:01:44,240 So, in this case, we have 44 44 00:01:44,240 --> 00:01:49,240 an interface Fa one slash zero ip group 100 in, 45 45 00:01:49,410 --> 00:01:51,950 and what's that saying is we're going to apply this 46 46 00:01:51,950 --> 00:01:53,800 to any incoming traffic. 47 47 00:01:53,800 --> 00:01:55,260 Now, in the case of this one, 48 48 00:01:55,260 --> 00:01:57,280 if we have traffic coming in from the Internet, 49 49 00:01:57,280 --> 00:02:00,280 like an HTTP reply, then it's going to get blocked 50 50 00:02:00,280 --> 00:02:01,800 because nothing is allowed in 51 51 00:02:01,800 --> 00:02:04,240 because we have a deny any statement here, 52 52 00:02:04,240 --> 00:02:05,970 even though the request was able to go out 53 53 00:02:05,970 --> 00:02:08,750 because that's outbound, anything coming back in 54 54 00:02:08,750 --> 00:02:12,020 is going to be blocked because we have an inbound deny rule. 55 55 00:02:12,020 --> 00:02:14,690 That's the bad thing about packet-filtering firewalls, 56 56 00:02:14,690 --> 00:02:16,750 they work just based on the rule sets, 57 57 00:02:16,750 --> 00:02:19,140 and so, if I have allow any going out, 58 58 00:02:19,140 --> 00:02:20,810 but I would deny any coming in, 59 59 00:02:20,810 --> 00:02:22,800 nothing's really going to work for us. 60 60 00:02:22,800 --> 00:02:25,380 Now, this is because they're all based off the ACL, 61 61 00:02:25,380 --> 00:02:28,040 and they're only based on the port or IP addresses. 62 62 00:02:28,040 --> 00:02:31,320 In this case, we blocked any port on any IP 63 63 00:02:31,320 --> 00:02:33,450 that's trying to make its way into our networks, 64 64 00:02:33,450 --> 00:02:35,610 that wouldn't make it for a very effective firewall 65 65 00:02:35,610 --> 00:02:36,710 if we want to be able to enable 66 66 00:02:36,710 --> 00:02:38,850 any kind of two-way communications. 67 67 00:02:38,850 --> 00:02:40,580 Now, the second type of firewall we have 68 68 00:02:40,580 --> 00:02:42,640 is what's called a stateful firewall, 69 69 00:02:42,640 --> 00:02:45,390 and they're going to inspect your traffic as part of a session. 70 70 00:02:45,390 --> 00:02:47,580 So, let's take the example here on the screen. 71 71 00:02:47,580 --> 00:02:49,690 If I'm sitting at PC1 and I make 72 72 00:02:49,690 --> 00:02:52,690 an SSH connection out to the server on the Internet, 73 73 00:02:52,690 --> 00:02:54,700 that is session one. 74 74 00:02:54,700 --> 00:02:58,220 Now, the server can then reply to me with that SSH traffic 75 75 00:02:58,220 --> 00:03:00,930 and the firewall is going to let it in, why? 76 76 00:03:00,930 --> 00:03:03,700 Because I opened the firewall by making the request. 77 77 00:03:03,700 --> 00:03:06,330 When I put the request out, it now expects a reply 78 78 00:03:06,330 --> 00:03:08,570 to come back and it's going to forward that to me. 79 79 00:03:08,570 --> 00:03:11,220 But if a second SSH server tried to come back 80 80 00:03:11,220 --> 00:03:12,650 and create its own session, 81 81 00:03:12,650 --> 00:03:14,750 the firewall is going to deny it, 82 82 00:03:14,750 --> 00:03:17,470 that's because this firewall can keep track of the fact 83 83 00:03:17,470 --> 00:03:19,070 that I made the initial request 84 84 00:03:19,070 --> 00:03:21,600 and I'm only going to get an answer to my request, 85 85 00:03:21,600 --> 00:03:23,850 anything else is going to be blocked. 86 86 00:03:23,850 --> 00:03:25,980 Now, you could see how this is a lot more beneficial 87 87 00:03:25,980 --> 00:03:27,700 than a packet-filtering firewall, 88 88 00:03:27,700 --> 00:03:30,360 because it's going to go ahead and not just let anything 89 89 00:03:30,360 --> 00:03:31,710 in or out, but it's going to keep track 90 90 00:03:31,710 --> 00:03:34,710 of what's been requested and only let those things in. 91 91 00:03:34,710 --> 00:03:36,480 With a packet-filtering firewall, I would have had 92 92 00:03:36,480 --> 00:03:39,180 to let everything in for SSH or everything out, 93 93 00:03:39,180 --> 00:03:40,680 it's either all or nothing. 94 94 00:03:40,680 --> 00:03:43,680 But in this case, we can keep track of these sessions 95 95 00:03:43,680 --> 00:03:46,370 and get a much more specific granularity of what's going to 96 96 00:03:46,370 --> 00:03:49,210 be going on here and what's going to be allowed and denied. 97 97 00:03:49,210 --> 00:03:50,890 This is what people are using when they're doing 98 98 00:03:50,890 --> 00:03:53,200 a phishing attack to explore your networks, 99 99 00:03:53,200 --> 00:03:54,780 because they know that most people 100 100 00:03:54,780 --> 00:03:56,750 are using session-based firewalls, 101 101 00:03:56,750 --> 00:03:59,570 and so, if I can send you an email and you click that link, 102 102 00:03:59,570 --> 00:04:01,940 what you just did was request a session, 103 103 00:04:01,940 --> 00:04:04,770 and that firewall is going to then open up the port 104 104 00:04:04,770 --> 00:04:05,603 and letting that out 105 105 00:04:05,603 --> 00:04:07,950 and let the reply back into your network, 106 106 00:04:07,950 --> 00:04:09,540 and that's why they're trying to do that. 107 107 00:04:09,540 --> 00:04:12,240 That is the bad thing about a stateful firewall. 108 108 00:04:12,240 --> 00:04:14,520 If you have users who are doing the wrong things, 109 109 00:04:14,520 --> 00:04:16,510 the firewall is going to let them through 110 110 00:04:16,510 --> 00:04:18,140 because they're making those requests, 111 111 00:04:18,140 --> 00:04:19,370 and since they requested it, 112 112 00:04:19,370 --> 00:04:21,520 it's going to let the bad stuff come back in. 113 113 00:04:21,520 --> 00:04:23,270 Now, we can combine the ACLs 114 114 00:04:23,270 --> 00:04:24,660 and the permit and deny statements 115 115 00:04:24,660 --> 00:04:26,360 of a packet-filtering firewall 116 116 00:04:26,360 --> 00:04:28,500 with a stateful firewall's capabilities, 117 117 00:04:28,500 --> 00:04:30,900 and this can give us a really good security device, 118 118 00:04:30,900 --> 00:04:33,760 and most modern firewalls will support both of those things 119 119 00:04:33,760 --> 00:04:35,580 and that's how they're going to work. 120 120 00:04:35,580 --> 00:04:37,140 The next type of firewall we have 121 121 00:04:37,140 --> 00:04:40,710 is known as a next-generation or next-gen firewall, 122 122 00:04:40,710 --> 00:04:43,830 these are also abbreviated as NGFW. 123 123 00:04:43,830 --> 00:04:46,680 Unlike stateful and stateless packet-filtering firewalls 124 124 00:04:46,680 --> 00:04:48,770 that operate at layer four and below, 125 125 00:04:48,770 --> 00:04:51,130 these third-generation firewalls can conduct 126 126 00:04:51,130 --> 00:04:54,360 what's known as deep packet inspection or DPI. 127 127 00:04:54,360 --> 00:04:57,230 This allows them to do full on packet-filtering. 128 128 00:04:57,230 --> 00:04:59,840 They're going to operate in layers five, six, and seven 129 129 00:04:59,840 --> 00:05:01,700 of the OSI model, where they can get 130 130 00:05:01,700 --> 00:05:03,810 really in-depth information and understand 131 131 00:05:03,810 --> 00:05:05,060 what those packets contain 132 132 00:05:05,060 --> 00:05:07,260 and whether it's bad for our networks or not. 133 133 00:05:07,260 --> 00:05:08,610 Now, these can also be referred 134 134 00:05:08,610 --> 00:05:10,340 to as a web application firewall, 135 135 00:05:10,340 --> 00:05:12,240 if they're specific to a web server 136 136 00:05:12,240 --> 00:05:15,870 or more generally, they're just called next-gen firewalls. 137 137 00:05:15,870 --> 00:05:18,140 If they're for your entire network, they're going to be 138 138 00:05:18,140 --> 00:05:20,210 a great use to you, because they're going to inspect 139 139 00:05:20,210 --> 00:05:22,470 all of the web traffic coming in and out 140 140 00:05:22,470 --> 00:05:23,460 and really understand 141 141 00:05:23,460 --> 00:05:25,620 what is going in and out of your network. 142 142 00:05:25,620 --> 00:05:28,080 Then, they can dig in and choose to whether 143 143 00:05:28,080 --> 00:05:30,740 allow it or deny it based on specific rule sets 144 144 00:05:30,740 --> 00:05:31,890 that you give it. 145 145 00:05:31,890 --> 00:05:34,450 When we talk about ACS or access control list, 146 146 00:05:34,450 --> 00:05:36,040 what exactly are they? 147 147 00:05:36,040 --> 00:05:38,070 Well, an ACL is simply a set of rules 148 148 00:05:38,070 --> 00:05:40,550 that are typically assigned to a router interface 149 149 00:05:40,550 --> 00:05:43,960 or a firewall and it's going to permit or deny certain traffic 150 150 00:05:43,960 --> 00:05:46,120 based on its IP address, its MAC address, 151 151 00:05:46,120 --> 00:05:48,710 or its port depending on what device you're dealing with. 152 152 00:05:48,710 --> 00:05:49,840 If you're dealing with a switch, 153 153 00:05:49,840 --> 00:05:51,730 it's going to be based off your MAC addresses. 154 154 00:05:51,730 --> 00:05:52,720 If you're dealing with a router, 155 155 00:05:52,720 --> 00:05:54,660 it's usually based off your IP addresses. 156 156 00:05:54,660 --> 00:05:55,800 If you're dealing with a firewall, 157 157 00:05:55,800 --> 00:05:58,530 it's going to based off your IP or your port. 158 158 00:05:58,530 --> 00:06:01,400 Now, the ACLs are going to do this based on your source IP, 159 159 00:06:01,400 --> 00:06:03,780 your destination IP, your source port, 160 160 00:06:03,780 --> 00:06:05,810 your destination port, your source MAC, 161 161 00:06:05,810 --> 00:06:07,380 or your destination MAC. 162 162 00:06:07,380 --> 00:06:09,070 Now, you can choose any or all of these 163 163 00:06:09,070 --> 00:06:11,850 to be the criteria you want based on your rule set. 164 164 00:06:11,850 --> 00:06:13,760 So, here's an example on the screen, 165 165 00:06:13,760 --> 00:06:16,300 I have three different access control list entries. 166 166 00:06:16,300 --> 00:06:17,280 I have the first one, 167 167 00:06:17,280 --> 00:06:20,200 which is going to permit or deny the first column. 168 168 00:06:20,200 --> 00:06:23,130 Now, the protocol you're using, whether it's TCP or UDP, 169 169 00:06:23,130 --> 00:06:24,570 is our second thing. 170 170 00:06:24,570 --> 00:06:26,990 And the next column we have is our source IP, 171 171 00:06:26,990 --> 00:06:29,700 and this can signify any or a specific IP 172 172 00:06:29,700 --> 00:06:31,840 that we want or a range of IPs. 173 173 00:06:31,840 --> 00:06:34,040 Then, we have a destination IP, and again, 174 174 00:06:34,040 --> 00:06:36,630 this can be any IP, a specific client, 175 175 00:06:36,630 --> 00:06:39,340 or an entire range depending on what you want. 176 176 00:06:39,340 --> 00:06:41,080 Then, we have our destination port, 177 177 00:06:41,080 --> 00:06:43,690 and then, we have things like WWW for port 80, 178 178 00:06:43,690 --> 00:06:47,420 SSH for port 22, Telnet that for port 23, 179 179 00:06:47,420 --> 00:06:48,840 you're getting the idea here, right? 180 180 00:06:48,840 --> 00:06:49,980 We're going to be able to decide 181 181 00:06:49,980 --> 00:06:52,300 what we're going to allow and what we're going to deny. 182 182 00:06:52,300 --> 00:06:53,810 So, in our case, we have this group 183 183 00:06:53,810 --> 00:06:56,270 on serial interface one slash zero 184 184 00:06:56,270 --> 00:06:58,620 that's going to be allowed on the inbound direction. 185 185 00:06:58,620 --> 00:06:59,900 We're going to apply these rules 186 186 00:06:59,900 --> 00:07:02,990 which are going to permit port 80 web traffic to come in. 187 187 00:07:02,990 --> 00:07:06,960 It's also going to permit SSH or port 22 to come in, as well, 188 188 00:07:06,960 --> 00:07:08,990 but it's going to deny port 23 189 189 00:07:08,990 --> 00:07:11,220 or Telnet traffic from coming in. 190 190 00:07:11,220 --> 00:07:13,550 Now, this is the way you can deal with ACLs. 191 191 00:07:13,550 --> 00:07:15,740 For your Network+ exam, you should be able to read 192 192 00:07:15,740 --> 00:07:18,100 an ACL just like I did here on the screen, 193 193 00:07:18,100 --> 00:07:20,370 but you don't need to come up with it by yourself 194 194 00:07:20,370 --> 00:07:23,330 for the exam and be able to create your own ACLs. 195 195 00:07:23,330 --> 00:07:25,580 Next, we have firewall zones. 196 196 00:07:25,580 --> 00:07:28,950 All firewall interfaces are classified as a certain zone. 197 197 00:07:28,950 --> 00:07:30,950 You can set up rules based on these zones 198 198 00:07:30,950 --> 00:07:33,660 so that all the inside rules apply to these interfaces 199 199 00:07:33,660 --> 00:07:35,020 and all the outside rules apply 200 200 00:07:35,020 --> 00:07:36,780 to those interfaces over there. 201 201 00:07:36,780 --> 00:07:38,650 Now, we have three zones we'd talk about, 202 202 00:07:38,650 --> 00:07:41,640 we have inside, outside, and DMZ. 203 203 00:07:41,640 --> 00:07:43,410 Now, inside is going to be your intranet, 204 204 00:07:43,410 --> 00:07:45,010 it's your local area network. 205 205 00:07:45,010 --> 00:07:47,140 It's connecting to your corporate local area network, 206 206 00:07:47,140 --> 00:07:49,500 and anytime you talk about things outside of that, 207 207 00:07:49,500 --> 00:07:51,470 you're going to be talking about things like the Internet 208 208 00:07:51,470 --> 00:07:53,450 or external to your network. 209 209 00:07:53,450 --> 00:07:56,170 Then, we have this other zone and it's known as the DMZ 210 210 00:07:56,170 --> 00:07:58,050 or demilitarized zone. 211 211 00:07:58,050 --> 00:07:59,230 It's going to connect devices 212 212 00:07:59,230 --> 00:08:00,750 that should have some restricted access 213 213 00:08:00,750 --> 00:08:03,830 from the outside zone, like web servers and email servers, 214 214 00:08:03,830 --> 00:08:05,690 but they still aren't necessarily trusted 215 215 00:08:05,690 --> 00:08:07,160 by your internal network. 216 216 00:08:07,160 --> 00:08:08,780 It's kind of this in-between land, 217 217 00:08:08,780 --> 00:08:11,860 between the trusted inside and the untrusted outside, 218 218 00:08:11,860 --> 00:08:13,360 and it's really part of your network, 219 219 00:08:13,360 --> 00:08:16,830 but it is segmented off as this demilitarized zone. 220 220 00:08:16,830 --> 00:08:18,450 Now, what does this really look like? 221 221 00:08:18,450 --> 00:08:20,570 Well, here's an example where I have three PCs 222 222 00:08:20,570 --> 00:08:22,580 and a switch, and they're going to be able to tie 223 223 00:08:22,580 --> 00:08:24,240 into this firewall and allow traffic 224 224 00:08:24,240 --> 00:08:25,970 to go between certain zones. 225 225 00:08:25,970 --> 00:08:27,420 Then, we have the DMZ, 226 226 00:08:27,420 --> 00:08:29,860 where my email and my web server up at the top. 227 227 00:08:29,860 --> 00:08:32,380 Then, I have this outside Internet zone over here. 228 228 00:08:32,380 --> 00:08:34,250 Now, if I have the untrusted Internet, 229 229 00:08:34,250 --> 00:08:36,560 am I going to allow traffic to go to my internal network 230 230 00:08:36,560 --> 00:08:38,010 or my inside network? 231 231 00:08:38,010 --> 00:08:40,010 Well, no, because I don't trust it. 232 232 00:08:40,010 --> 00:08:41,120 The only way I'm going to do that 233 233 00:08:41,120 --> 00:08:42,620 is if somebody has requested it, 234 234 00:08:42,620 --> 00:08:44,570 like using a stateful firewall. 235 235 00:08:44,570 --> 00:08:46,440 So, in general, we're going to block everything 236 236 00:08:46,440 --> 00:08:48,980 going from the Internet to my internal zone. 237 237 00:08:48,980 --> 00:08:51,840 Now, from my internal zone to my DMZ, again, 238 238 00:08:51,840 --> 00:08:53,920 I don't really fully trust that DMZ, 239 239 00:08:53,920 --> 00:08:55,820 so we're going to treat it like the Internet 240 240 00:08:55,820 --> 00:08:57,440 from our internal network. 241 241 00:08:57,440 --> 00:08:59,310 Now, if we request information from the email 242 242 00:08:59,310 --> 00:09:01,800 or the web server, we'll get return traffic, 243 243 00:09:01,800 --> 00:09:03,410 so that's going to be good for us. 244 244 00:09:03,410 --> 00:09:05,440 But in general, we're going to block a lot of traffic 245 245 00:09:05,440 --> 00:09:07,030 between those two zones. 246 246 00:09:07,030 --> 00:09:09,800 Then, let's talk about the DMZ to the outside. 247 247 00:09:09,800 --> 00:09:12,330 Well, the DMZ should always be able to go out 248 248 00:09:12,330 --> 00:09:13,760 so they can request whatever they want 249 249 00:09:13,760 --> 00:09:15,770 from the outside or from the Internet, 250 250 00:09:15,770 --> 00:09:18,530 and we do have to allow certain things to come into the DMZ, 251 251 00:09:18,530 --> 00:09:20,820 things like port 25 for sending an email 252 252 00:09:20,820 --> 00:09:25,590 or port 110 for POP3, or port 143 for IMAP. 253 253 00:09:25,590 --> 00:09:27,790 Those email type services need to be able 254 254 00:09:27,790 --> 00:09:29,760 to have inbound traffic from the Internet 255 255 00:09:29,760 --> 00:09:32,020 because that's what an email service is designed to do, 256 256 00:09:32,020 --> 00:09:33,630 to serve those emails. 257 257 00:09:33,630 --> 00:09:35,370 The same thing is true for the web server, 258 258 00:09:35,370 --> 00:09:38,220 We're going to need to allow port 80 and port 443 259 259 00:09:38,220 --> 00:09:40,110 for unsecured and secure web browsing 260 260 00:09:40,110 --> 00:09:41,700 if we're going to host a web server, 261 261 00:09:41,700 --> 00:09:42,950 because if we're running a web server, 262 262 00:09:42,950 --> 00:09:46,200 people outside our network need to get to those web servers. 263 263 00:09:46,200 --> 00:09:47,407 That's why the DMZ is considered 264 264 00:09:47,407 --> 00:09:49,470 the semi-trusted zone, because people 265 265 00:09:49,470 --> 00:09:52,680 from outside our networking reach in and touch the DMZ. 266 266 00:09:52,680 --> 00:09:53,880 We wouldn't want them to reach and touch 267 267 00:09:53,880 --> 00:09:57,230 our internal network, but we can get to those DMZ servers. 268 268 00:09:57,230 --> 00:09:58,750 Now, we can really lock it down 269 269 00:09:58,750 --> 00:10:01,050 and put a lot of protections in place, but we still have 270 270 00:10:01,050 --> 00:10:03,930 to have some kind of open access to it because otherwise, 271 271 00:10:03,930 --> 00:10:05,370 the email server and the web server 272 272 00:10:05,370 --> 00:10:07,200 don't give us any functionality, right? 273 273 00:10:07,200 --> 00:10:09,320 And so, that's the idea here with a DMZ, 274 274 00:10:09,320 --> 00:10:11,000 it's a semi-trusted zone 275 275 00:10:11,000 --> 00:10:13,490 between the inside and the outside network. 276 276 00:10:13,490 --> 00:10:15,400 Now, the last type of device I want to mention here 277 277 00:10:15,400 --> 00:10:18,930 is called a UTM or a unified threat management system. 278 278 00:10:18,930 --> 00:10:20,810 Now, these have been getting a lot of popularity 279 279 00:10:20,810 --> 00:10:22,820 in recent years, and this is a device 280 280 00:10:22,820 --> 00:10:24,950 that's going to combine your firewall, your router, 281 281 00:10:24,950 --> 00:10:27,360 your intrusion detection and intrusion prevention systems, 282 282 00:10:27,360 --> 00:10:30,600 antimalware solutions you have, and other security devices, 283 283 00:10:30,600 --> 00:10:33,550 all into a single device that's placed on your network. 284 284 00:10:33,550 --> 00:10:35,710 This is generally considered a border device, 285 285 00:10:35,710 --> 00:10:39,110 and it really is a next-generation next-generation firewall. 286 286 00:10:39,110 --> 00:10:41,230 Now, there's an agent that's running your internal clients 287 287 00:10:41,230 --> 00:10:43,200 and they can be queried by the UTM 288 288 00:10:43,200 --> 00:10:45,380 before allowing any connection to the network. 289 289 00:10:45,380 --> 00:10:48,330 They can also serve with a NAC or a network authentication 290 290 00:10:48,330 --> 00:10:50,750 and network authorization function prior to allowing 291 291 00:10:50,750 --> 00:10:53,150 any new devices onto your network, as well. 292 292 00:10:53,150 --> 00:10:55,360 Now, these unified threat managers can be purchased 293 293 00:10:55,360 --> 00:10:57,700 as a physical device to be installed in your networks 294 294 00:10:57,700 --> 00:10:59,340 or there can be a virtualized device, 295 295 00:10:59,340 --> 00:11:02,680 and there's even cloud solutions out there with UTMs, too. 296 296 00:11:02,680 --> 00:11:04,590 If you're using a cloud solution, you'll just route 297 297 00:11:04,590 --> 00:11:06,750 all your traffic to this cloud service provider 298 298 00:11:06,750 --> 00:11:08,580 and they'll do all the security for you, 299 299 00:11:08,580 --> 00:11:11,130 and then, they route your traffic out to the Internet, 300 300 00:11:11,130 --> 00:11:14,360 because of this, UTMs are really expanding in popularity, 301 301 00:11:14,360 --> 00:11:16,270 and you're going to see them more and more in networks 302 302 00:11:16,270 --> 00:11:19,400 because they have this always on, always updated signatures 303 303 00:11:19,400 --> 00:11:20,860 with the latest threat information 304 304 00:11:20,860 --> 00:11:22,290 and the latest threat intelligence 305 305 00:11:22,290 --> 00:11:24,700 that provides you additional security for your networks, 306 306 00:11:24,700 --> 00:11:27,347 more so than a firewall alone could do for you.