Firewalls

Question 1

How many entry/exit points do modern networks have?

Answer 1

Modern network designs have a single fortified point of

entry/exit.

Question 2

What 4 types of firewall are there?

Answer 2

The principal types of firewall are:
packet-filtering firewalls;
stateful packet inspection firewalls;
application-level gateways;
circuit-level gateways.

Question 3

How does a packet-filtering firewall work?

Answer 3

A packet-filtering firewall filters individual packets on the basis of packet headers and packet payloads.
A shallow packet inspection examines packet headers.
A deep packet inspection examines the packet payload.
ONE PACKET AT A TIME

Question 4

Give examples of the sorts of packet header fields and

packet payloads and a packet-filtering firewall might look for

Answer 4

Particular source/destination IP addresses/TCP ports

Particular payload content containing signatures of malware.

Question 5

How does a stateful packet inspection firewall work?

Answer 5

A stateful packet inspection firewall filters incoming
individual packets on the basis of a directory of established outgoing TCP connections.

So it checks a packet to see if it is not from an established.

Question 6

How does application-level gateway work?

Answer 6

An application-level gateway operates at the application level, working on application headers or content.
For example: a Web or e-mail gateway.
Decides what workload it should be undertaking.

Question 7

How does circuit-level gateways work?

Answer 7

A circuit-level gateway sets up two TCP connections: one from inside to the firewall, and one from firewall to the outside, if allowed.
Very slow

Question 8

Firewall organisations include:

Answer 8

1) single bastion inline;

2) double bastion inline.

Question 9

What does a single firewall inline do?

Answer 9

A single firewall inline puts a firewall (or bastion) between an external and internal router

Question 10

What does a double firewall inline do?

Answer 10

A double firewall inline puts a Demilitarised Zone (DMZ)

between an external and internal firewall (or bastion).

Question 11

What is the demilitarised zone?

Answer 11

The Demilitarised Zone (DMZ) is a network for systems that must be externally accessible, but still need some protection.
Examples: Web, e-mail and Domain Name System (DNS)
servers.

Question 12

A Linux firewall how does it work ?

Answer 12

A Linux firewall processes packets at five hook points.