Firewalls + IDS/IPS

Question 1

What do Packet Filters check and which level of the OSI model do they operate on?

Answer 1

Layers 3 + 4 (Network and Transport).

Check: Protocol, Source IP, Destination IP, Source TCP/UDP port #, Destination TCP/UDP port #.

• Does not inspect the CONTENTS of the packet. Only the Header.

Question 2

What do Stateful Inspection firewalls check and which level of the OSI model do they operate on?

Answer 2

Layers 3, 4, + 5. (Network, Transport, Session).

Protects the state (or connection) between 2 points. Creates temporary rules to taper down on traffic. Inspects traffic state to confirm that the connection fits the correct criteria. Does NOT inspect packet contents.

Question 3

What do Application Aware Firewalls check and which level of the OSI model do they operate on?

Answer 3

Layers 1 - 7. App level Firewalls inspect packet contents. Also known as Layer 7 Firewall.

Question 4

What is IDS?

Answer 4

IDS (Intrusion Detection System). Uses reputation-based protection which alerts when there is potentially dangerous traffic.

Listens only, does not interfere.

Question 5

What is IPS?

Answer 5

Intrusion Protection System. Uses reputation-based protection. IPS is in-line, typically, and can interfere with suspicious network traffic.