Chapter 6 - Firewalls Flashcards
If the packet is not a provable attack packet, the firewall passes the packet on to its destination.
This is called a __________.
Pass/deny decision
Firewalls usually record information about each dropped packet in a __________.
This process is called __________.
- Log file
2. Logging
Many firms have ______ which filter traffic through different parts of the internal network.
Internal firewalls
The firewall which examines packets entering the network from the outside is called _________.
Ingress filtering
The firewall which examines packets leaving the network from the inside is called _________.
Egress filtering
Firewalls must be able to filter traffic at _____ which is the maximum speed of the lines that are connected to it.
Wire speed
What are the six types of filtering methods?
- Stateful packet inspection filtering.
- Static packet filtering.
- Network address translation.
- Application proxy filtering.
- Intrusion prevention system filtering.
- Antivirus filtering.
All main border firewalls use _____.
Stateful packet inspection (SPI)
What type of filtering looks at packets one at a time while isolated?
Static packet filtering
What types of attacks can ‘static packet filtering’ stop?
- Internet Control Message Protocol (ICMP) echo messages.
2. Packets that are spoofed with different IP addresses.
Static packet filtering is not used as a _____.
Main border firewall filtering mechanism.
“Nearly all” corporate border firewalls use the _____.
Stateful packet inspection (SPI) filtering method.
SPI focuses on _____ which are _____ b/w different programs on different computers.
- Connections
2. Persistent conversations
A _____ is a distinct phase in a connection b\w two applications.
State
_____ uses specific examination methods depending on the _____ of the _____.
- Stateful packet inspection
- State
- Connection
The vast majority of _____ are not a part of _____.
- Packets
2. Connection-opening attempts
In SPI, if the _____ is part of an existing connection, the packet is passed, usually without further _____.
- Packet
2. Filtering
In SPI, if the _____ is not part of an existing connection, the packet is _____ and _____.
- Packet
- Dropped
- Logged
_____ consist of a series of rules that are _____ to the default behavior.
- Access control lists
2. Exceptions
A secondary type of protection used in firewalls is _____.
Network address translation (NAT)
What ranges from 1024 to 4999?
Ephemeral port numbers
The _____ firewall intercepts all _____ traffic and replaces source __ addresses and source ____ numbers with (stand-in) external versions.
- NAT
- Outgoing
- IP
- Port
What are some types of application proxy firewall protections?
- Internal IP address hiding.
- Header destruction.
- Protocol fidelity.
Traditional firewalls don’t what?
Don’t do antivirus filtering.
Unified Threat Management (UTM) Firewalls use what methods?
- SPI
- Antivirus filtering
- VPNs
- DoS protection
- NAT
Intrusion Prevention Systems (IPSs) use… and can…
IDS filtering methods, as well as being able to stop ‘some’ kinds of attacks rather than only identifying threats.
If the packet is a _______ the firewall drops the packet.
Provable attack packet
Heavy processing requirements involving IDSs are due to what types of methods?
- Deep Packet Inspection (DPI).
2. Packet Stream Analysis (PSA).
What do IPSs do when they detect potentially suspicious traffic at the high end of the Attack Identification Confidence Spectrum (AICS)?
- Drop packets (dangerous but highly effective).
2. Bandwidth limitation.
Unified Threat Management (UTM) embraces both _____ firewalls and _____ filtering methods.
- Traditional
2. Antivirus
Main Border Firewalls are…
At the point where the corporate network connects to the Internet.
Between the border firewall and the Internet is the sites _____ and stops simple _____.
- Screening border router
2. High-volume
What is a positive of the SBR?
It economically reduces the load on the main border firewall.
Internal Firewalls do what?
Internal firewalls control the traffic flow in b/w different parts of the firms internal network.
What is a Host Firewall?
A host-based firewall is a piece of software running on a single host that can restrict incoming and outgoing network activity for that host only.
What does one create when using (1) border, (2) internal, and (3) host firewalls?
It creates defense-in-depth.
The border firewall is multihomed, meaning that it…
Connects to multiple subnets.
What is the DMZ?
A subnet that contains all of the servers and application proxy firewalls that must be accessible to the outside world.
