3Com 10014299 manual Classification of Firewalls

548CHAPTER 39: CONFIGURING FIREWALL

Classification of Firewalls

Usually firewalls are divided into two types: network layer firewalls and application layer firewalls. A network layer firewall mainly obtains the packet head information of data packets, such as protocol number, source address and source port, destination address and destination port, or directly obtains the data of a packet head. But an application layer firewall analyzes the whole information stream.

Commonly used firewalls include the following:

■Application Gateway: checks the application layer data of all data packets passing through this gateway. For example, the FTP application gateway will be a FTP server to a connected client end, but will be an FTP dlient to the server end. All FTP data packets transmitted on the connection must pass through this FTP application gateway.

■Packet Filtering: filters each data packet using the user-defined items. For example, to check if the source address and destination address of a data packet meet the rules. Packet filtering does not check call status, nor does it analyze the data. If data packets with port 21 or greater than or equal to 1024 are allowed to pass, then once a port meets this condition, the data packet can pass this firewall. If the rules are configured, then many data packets with hidden security troubles can be filtered out on this layer.

■Proxy: normally refer to address proxy on a proxy server or a router. It replaces the IP address and port of a host inside the network with the IP address and port of a server or router. For example, the intranet address of an enterprise is 129.0.0.0 network segment, and its formal external IP address is 202.38.160.2-202.38.160.6. When the internal host 129.9.10.100 accesses a certain external server in WWW mode, the IP address and port might become 202.38.160.2:6080 after passing through the proxy server. An address mapping table is maintained in the proxy server. When the external WWW server returns the result, the proxy server will convert this IP address and port into the internal IP address and port 80 of the network. The proxy server is used so that all access between the external network hosts and the internal network occurs through this proxy server. In this way, the access to internal devices that contain important resources can be controlled.

Packet Filtering Usually, packet filtering refers to filtering for IP data packets forwarded. For the data packets that need to be forwarded by a router, first the packet header information, including the number of the upper layer protocol carried by the IP layer, the packet's source/destination address and source/destination port is obtained. Then the information is compared with the set rules. Finally, it is decided whether to transfer or discard the data packet according to the comparison result.

Packet filtering (for IP data packets) selects the following elements for judgment (in the figure, the upper layer protocol carried by IP is TCP), as shown in the figure below.