Firewall (Network Firewall used by Network)
- 1. Intro to Firewalls, Security Zones & Security Policies
- 2. What is a Firewall ? Acts as a security gateway between two networks Usually between trusted and untrusted networks (such as between a establishment network and the Internet) Internet Network Gateway
- 3. What is a Firewall ? Tracks and controls network communications Decides whether to pass, reject, encrypt, or log communications (Access Control) “Allow Traffic to Internet” Internet “Block traffic from Internet”
- 4. What is a Firewall? A choke point of control and monitoring Interconnects networks with differing trust Imposes restrictions on network services • only authorized traffic is allowed Auditing and controlling access • can implement alarms for abnormal behavior Itself immune to penetration Provides perimeter defence
- 5. Why Firewalls are Needed Prevent attacks from untrusted networks Protect data integrity of critical information Preserve customer and partner confidence
- 6. Implementation of Firewalls A firewall may be implemented as a standalone hardware device or in the form of a software on a client computer or a proxy server • The two types of firewall are generally known as the hardware firewall and the software firewall A firewall that stands in between two networks will inspect a packet that is ready to pass between the networks and allow or block the packet based on the rules set for the firewall to operate
- 7. General Firewall Features Port Control Network Address Translation Application Monitoring (Program Control) Packet Filtering Data encryption Reporting/logging e-mail virus protection Pop-up ad blocking Cookie digestion Spy ware protection
- 9. SRX High End Portfolio SRX 3600 SRX 3400 SRX 5600 SRX 5800
- 10. SRX Branch Portfolio Large Branch/Regional Office Small Office SRX100 Small to Medium Office SRX210 SRX650 SRX240 SRX220
- 11. SRX Series—Firewall, Zones, & Policies ZONE “UNTRUST” Originating Zone SRX ZONE “Accounting” ZONE “Trust” Policy—Deny All Policy—Allow All INTERNET Originating Zone ZONE “Guest” Originating Zone
- 12. Security Zone A security zone is a collection of one or more network segments requiring the regulation of inbound and outbound traffic through policies Traffic enters into one security zone and goes out on another security zone
- 13. Types Functional Zone • Used for special purposes, like management interfaces Security Zone • Logical entities to which one or more interfaces are bound • Building blocks for policies Trust Zone/ Untrust Zone • Available only in the factory configuration • Used for initial connection to the device
- 14. Zone Config Configuring Host Inbound Traffic Inbound traffic from devices directly connected to the device's interfaces is dropped by default Protect the device against attacks launched from systems Can prohibit use of other applications on the same or different interfaces of a zone Must enable all expected host-inbound traffic Zone Creation
- 15. Security Policies • To allow traffic to pass from one security zone to another in each dir Zone A Zone B Zone B Zone A
- 16. Security Policies Policies perform the actions on the traffic attempting to cross from one security zone to another • Deny • Permit • Reject • Encrypt • Decrypt • Authenticate • Prioritize • Filter • Monitor
- 17. Security Policies Each policy is associated with match criteria as : A source zone A destination zone One or many source address names/address set names One or many destination address names/ address set names One or many application names/application set names
- 18. 2 3 Security Policy: from private zone to external zone If Source IP address = Host B Destination IP address = Host D Application = SSH then permit traffic Internet D B Steps: 1. Host B initiates SSH to Host D Flow B D 2. Security policy permits that flow 3. The flow triggers reverse flow creation; both flows result in a formed session 4. The return traffic, Host D Host B receives permission also External Zone Private Zone B Public Zone A 1 2 4 Source Address Prot Source Port B D 6 6 29200 22 Destination Address Destination Port Int 22 D B 29200 . ge-0/0/0 ge-1/0/0 Session Table C Security Policy Conceptual Example
- 19. D B Devise security policies as per fol criteria: Host A will be able to comm with Host C and D. Host B can comm with Host C and vice versa. Host C can comm with D. D can comm with all on smtp except B. D can only accept smtp traffic B A C Scenario
- 20. From Host To Host Application Action Host A Host C Any Permit Host A Host D SMTP Permit Host B Host C Any Permit Host C Host B Any Permit Host C Host D SMTP Permit Host D Host B Any Deny Any Host D SMTP Permit Scenario
- 21. THANK YOU