Network Firewall Flashcards
Routing
TL;DR for Network Firewall?
Protects your VPCs
Routing
Does a NF protect incoming or outgoing traffic?
Both
Routing
Is NF simple filtering or deep-packet inspection?
Yes to both
Routing
How/where do you put NF in your VPC?
It’s just ENIs: create dedicated subnets, put NF ENIs in each
Routing
How do you get inbound traffic to go thru the NF?
IGW Route Table sends incoming packets from IGW to the NF ENIs
Routing
How do you get outbound traffic to go thru the NF?
Just like NAT GWs: Route Tables send 0.0.0.0/0” to the NF subnets
Routing
Is NF HA?
Yes if you create multiple ENIs in different AZs
Configuration
Top-level thing that holds all configuration for a NF?
Firewall Policy
Configuration
Limit on the number of Firewall Policies per NF?
1
Configuration
Can a Firewall Policy be shared with other NF?
Yes
Configuration
What’s inside a Firewall Policy?
Rule Groups (which hold Rules)
Configuration
Are Rules stateful or stateless?
Both! You pick.
Configuration
What are the different actions a Rule can take?
Pass, drop, forward, custom (for stateful rules)
Configuration
What is the “5-Tuple”?
source IP, source port, dest IP, dest port, protocol (like TCP vs. UDP)
Configuration
What are the two Engines in a NF?
Stateless Engine and Stateful Engine
Stateless Engine
What’s the default action if a packet doesn’t match a stateless Rule?
Whatever you configured
Stateless Engine
How can the two Engines interact?
Stateless can forward a packet to the Stateful engine (but not the other direction)
Stateless Engine
What sequence are stateless Rules processed?
Priority Order (lowest number is highest priority)
Stateless Engine
What happens if two stateless Rules match a packet being inspected?
Doesn’t happen: Engine stops as soon as it finds a Rule that matches
Stateless Engine
What do stateless Rules operate on?
5-Tuple
Stateful Engine
What’s the Stateful Engine code base?
Suricata (open standard)
Stateful Engine
How does the stateful engine interact with the stateless engine?
It doesn’t
Stateful Engine
What sequence are stateful rules processed?
Depends: choose from Strict Order or Action Order
Stateful Engine
What is Strict Order?
Evalutes each rule one-at-a-time, in the order you list them
Stateful Engine
What is Action Order?
Evaluate all pass rules, then all drop rules, then all reject rules
Stateful Engine
What do stateful Rules operate on:
5-Tuple + domain names + entire packet (deep-packet inspection)
