One of the most common
network security devices out there is a firewall.
Now, we've talked about firewalls briefly
up to this point, but in this video,
we're really going to dive deeper into firewalls
to really understand the type of firewalls
that are out there and how they operate.
Now, when we look at firewalls, they use a set of rules
to define the types of traffic that's going to be permitted
or denied through that device.
They basically act as a barrier to our networks.
These can be either software-based or hardware-based,
and they can be virtual or physical devices.
They can also be on the host or they can be on the network,
depending on if they're a host-based firewall
or a network-based firewall.
It really depends on your implementation,
but they're all going to work in pretty much the same way.
The other thing that a firewall can do for you,
especially a physical one that's sitting
at the edge of your network,
is to perform your network address translation, or your NAT,
or if you're using port address translation, PAT,
it can do that for you, too.
Now, that way you can use one public IP
and many private IPs.
The first type of firewall we're going to talk about
is called a packet-filtering firewall.
These packet-filtering firewalls are going to permit
or deny traffic based on a packet's header,
so they have to access that packet
and they have to look at the header
and look for the source or destination IP
and the source or destination port.
It's then going to look at each of those packets individually
and make decisions whether to permit them or deny them
based on its access control list inside the firewall.
So here on the screen, I have an access control list,
and this access control list has "100 deny ip any".
Now, what does that mean?
It means that any IP that is going to be denied
if it meets these rules.
100 is the line number, deny is the action,
IP is the protocol,
any is the action against which it's going to take.
So in this case, we have an interface, Fa 1/0,
IP group 100 in, and what's that saying
is we're going to apply this to any incoming traffic.
Now, in the case of this one,
if we have traffic coming in from the internet,
like an HTTP reply, then it's going to get blocked,
because nothing is allowed in
because we have a deny any statement here.
Even though the request was able to go out,
because that's outbound, anything coming back in
is going to be blocked,
because we have an inbound deny rule.
That's the bad thing about packet-filtering firewalls.
They work just based on the rulesets,
and so if I have a allow any going out,
but I have a deny any coming in,
nothing's really going to work for us.
Now, this is because they're all based off the ACL,
and they're only based on the port or IP addresses.
In this case, we've blocked any port on any IP
that's trying to make its way into our networks.
That wouldn't make it for a very effective firewall
if we wanted be able to enable any kind
of two-way communications.
Now, the second type of firewall we have
is what's called a stateful firewall,
and they're going to inspect your traffic as part of a session.
So let's take the example here on the screen.
I'm sitting at PC one, and I make an SSH connection
out to the server on the internet.
That is session one.
Now, the server can then reply to me with that SSH traffic,
and the firewall's going to let it in.
Why? Because I opened the firewall by making the request.
I put the request out, it now expects a reply to come back,
and it's going to forward that to me.
But if a second SSH server tried to come back
and create its own session,
the firewall is going to deny it.
That's because this firewall can keep track of the fact
that I made the initial request,
and I'm only going to get an answer to my request.
Anything else is going to be blocked.
Now, you can see how this is a lot more beneficial
than a packet-filtering firewall,
because it's going to go ahead
and not just let anything in or out,
but it's going to keep track of what's been requested
and only let those things in.
With a packet-filtering firewall,
I would've had to let everything in for SSH
or everything out.
It's either all or nothing.
But in this case, we can keep track of these sessions
and get a much more specific granularity
of what's going to be going on here
and what's going to be allowed and denied.
This is what people are using
when they're doing a phishing attack
to exploit your networks, because they know that most people
are using session-based firewalls,
and so if I can send you an email and you click that link,
what you just did was request a session,
and that firewall is going to then open up the port
as letting that out
and let the reply back into your network,
and that's why they're trying to do that.
That is the bad thing about a stateful firewall.
If you have users who are doing the wrong things,
the firewall is going to let them through
because they're making those requests,
and since they requested it,
it's going to let the bad stuff come back in.
Now, we can combine the ACLs
and the permit and deny statements
of packet-filtering firewalls
with a stateful firewalls capabilities,
and this can give us a really good security device,
and most modern firewalls will support both of those things,
and that's how they're going to work.
The next type of firewall we have
is known as a next-generation or next-gen firewall.
These are also abbreviated as NGFW.
Unlike stateful and stateless packet-filtering firewalls
that operate at layer four and below,
these third-generation firewalls can conduct
what's known as deep packet inspection, or DPI.
This allows them to do full-on packet filtering.
They're going to operate in layers five, six,
and seven of the OSI model,
where they can get really in-depth information
and understand what those packets contain
and whether it's bad for our networks or not.
Now, these can also be referred to
as a web application firewall
if they're specific to a web server,
or more generally, they're just called next-gen firewalls.
If they're for your entire network,
they're going to be a great use to you,
because they're going to inspect all of the web traffic
coming in and out and really understand
what is going in and out of your network.
Then, they can dig in and choose to whether allow it
or deny it based on specific rulesets that you give it.
When we talk about ACLs or access control lists,
what exactly are they?
Well, an ACL is simply a set of rules
that are typically assigned to a router interface
or a firewall, and it's going to permit or deny certain traffic
based on its IP address, its MAC address, or its port,
depending on what device you're dealing with.
If you're dealing with a switch,
it's going to be based off your MAC address.
If you're dealing with a router,
it's usually based off your IP address.
If you're dealing with a firewall,
it's going to be based off your IP address or your port.
Now, the ACLs are going to do this based on your source IP,
your destination IP, your source port,
your destination port, your source MAC,
or your destination MAC.
Now, you can choose any or all of these
to be the criteria you want based on your ruleset.
So here's an example on the screen.
I have three different access control list entries.
I have the first one,
which is going to permit or deny the first column.
Now, the protocol you're using,
whether it's TCP or UDP, is our second thing,
and the next column we have is our source IP,
and this can signify any or a specific IP that we want
or a range of IPs.
Then we have a destination IP,
and again, this can be any IP, a specific client,
or an entire range, depending on what you want.
Then we have our destination port,
and then we have things like WWW for port 80,
SSH for port 22, telnet for port 23.
You're getting the idea here, right?
We're going to be able to decide what we're going to allow
and what we're going to deny.
So in our case, we have this group on serial interface 1/0
that's going to be allowed on the inbound direction.
We're going to apply these rules,
which are going to permit port 80 web traffic to come in.
It's also going to permit SSH or port 22 to come in as well,
but it's going to deny port 23, or telnet traffic,
from coming in.
Now, this is the way you can deal with ACLs.
For your Network+ exam, you should be able to read an ACL
just like I did here on the screen,
but you don't need to come up with it by yourself
for the exam and be able to create your own ACLs.
Now, the last type of device I want to mention here
is called a UTM, or a unified threat management system.
Now, these have been gaining a lot of popularity
in recent years, and this is a device
that's going to combine your firewall, your router,
intrusion detection and intrusion prevention system,
any malware solutions you have,
and other security devices all into a single device
that's placed on your network.
This is generally considered a border device,
and it really is a next-generation next-generation firewall.
Now, there's an agent that's running your internal clients,
and they can be queried by the UTM
before allowing any connection to the network.
They can also serve with a NAC, or a network authentication
and network authorization function,
prior to allowing any new devices onto your network as well.
Now, these unified threat managers can be purchased
as a physical device to be installed in your networks
or they could be a virtualized device,
and there's even cloud solutions out there with UTMs, too.
If you're using a cloud solution,
you'll just route all your traffic
to this cloud service provider,
and they'll do all the security for you,
and then they route your traffic out to the internet.
Because of this, UTMs are really expanding in popularity,
and you're going to see them more and more in networks
because they have these always-on, always-updated signatures
with the latest threat information
and the latest threat intelligence
that provides you additional security for your networks,
more so than a firewall alone could do for you.