Connect802 is a nationwide wireless network equipment reseller providing system design consulting, equipment configuration, and installation services.

Call today and ask about your 30% design discount when you buy a Wi-Fi wireless network from Connect802
 

Understanding Firewalls and Firewall Appliances

Connect802 can help with the selection and system design for many manufacturer's firewall appliances and integrated firewall systems. We are also an authorized, value-added reseller for a number of major manufacturer's products.

If you have questions, please don't hesitate to call us today! We'll be happy to provide you with any technical explanation that you need to help you assure a successful wireless networking deployment.

A firewall, commonly implemented as part of a router or wireless LAN switch, inspects connections passing through it and enforces access control policies on the communicating users.

Why "fire" wall?

In the construction industry, a "fire wall" is a partition in a building that is built to help prevent a fire from spreading into an occupied part of the building. In the automotive and aviation industry the "firewall" separates the engine from the occupants and protects the occupants in case of an engine fire. A Firewall Router protects against unauthorized access to one or more parts of a network on the basis of various characteristics of the attempted connection.

How does the protection offered by a Firewall Router differ from the 802.1x and WPA protection in a WLAN?

802.1x and WPA Authentication creates a barrier to entry at the edge of the network (through the WLAN). Encryption protects the information content of data in transit. In some cases it's not possible to authenticate users at the edge. For example, in a public HotSpot the users must be granted connection access to the wireless network in order to access the login web page where they then supply their userid and password. In this case the user authentication occurs after the wireless device has attached to the network. When access control takes place at the edge the user, once attached to the WLAN, has complete access to all parts of the interconnected network, unless otherwise restricted inside the network. That's what a Firewall Router does. It creates access barriers in the core of the wired infrastructure, blocking access to specified parts of a network based on security policies specifying what, and who, has rights to which areas.

802.1x / WPA = Edge Access Control
Firewall Router = Internal Access Control

When should a Firewall Router be added to a Wi-Fi wireless network's design?

You can see that if the client computer (far left) can gain access through the WLAN access points at the edge then communication through the switch (to which the access points are attached) and the core router gives the WLAN client access to the entire wired Intranet as well as to the Internet.

A Firewall Router (as opposed to a simple Layer 3 legacy router) as the core connectivity device in a network acts to block access according to the rules of the security policy. For example, in the picture shown above, a Firewall Router could allow WLAN users to access the Internet, but not the in-building Intranet. It could also allow (for example) wireless access only to the in-building printers, but not to the file servers. Any combination of access control rights can be enforced with a high-end Firewall Router.

 

Definitions and descriptions of Firewall Routers that you might find on the web:

  • A router which blocks traffic according to various criteria for security--for example a router which allows no telnet to any host through one of its interfaces but allows ftp to a list of authorized hosts through the same interface.
  • The basic functionality of a firewall is fairly straightforward: it's installed between the LAN and the Internet, and it examines and potentially blocks (i.e.: "filters") based on information in the Layer 3 and 4 headers (IP, TCP, UDP, ICMP). The decision to accept or reject a packet is often based on the source or destination address or port number. More sophisticated firewalls add features to examine packet streams at the Application Layer (DNS, SMTP, POP3, SNMP).
  • Features of high-end, business-class firewall appliances include:
    • VPN monitoring and control
    • Centralized management of multiple firewall devices
    • Reporting and alerting functions
    • Distributed security policies
    • Load balancing, fail-over, and other high-end router-related functions
    • Web caching, spam filtering, URL screening, and anti-virus features
  • Stateful inspection firewalls overcome the limitations of packet filter firewalls and application proxy servers. They examine more than just the "to" and "from" addresses in the data packets, and do not require a proxy for every application being accessed. Stateful inspection firewalls determine whether packets can get through the firewall based on the protocol, port, and source and destination addresses. For every request that is allowed by this strategy, stateful inspection firewalls open up a limited time window to allow response packets, but ONLY from the same host. Also, by maintaining information about previous packets, stateful inspection firewalls can quickly verify that packets meet the criteria for authorized traffic, making them inherently fast.
  • Stateful inspection firewalls determine whether packets can get through the firewall based on the protocol, port, and source and destination addresses.
  • Firewall HTTP Filtering allows you to prevent intrusion attempts targeted at your web server by screening requests and automatically banning the offender's IP address, preventing further access.
  • A "honeypot" or "tar pit" is a feature designed to trap hackers or intruders by accepting TCP connections and responding (or purposely not responding) in a manner designed to present a behavior that will foil the intrusion attempt and give the network administrator a notification that someone is attempting to penetrate network security. For example, the unauthorized intruder may be given access to a file server with dummy information on it and, while the intruder is examining the dummy server, the network manager is isolating the location and identity of the intruder.
  • Firewall is a system (software, often built into router hardware) designed to prevent unauthorized access to or from a private network. Firewalls may be implemented in both hardware and software. Frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets, messages entering or leaving the intranet enter through the firewall, which examines each message, and blocks those not meeting the specified security criteria.
  • An Application Firewall monitors any desktop application that attempts to access the Internet, and requests authorization for each application. This feature prevents spying software such as Trojans and backdoors from accessing the Internet from your PC. This makes these Trojans useless to hackers.
 
Jump to the top of the current pagePhone numbers and email address list for Connect802On-line form for product questions, web error reporting, or general feedback
The Contents Of This Website Are Subject To Copyright - Unauthorized Reproduction Prohibited