Section 2

Seite 1

Firewalls-Control flow of traffic , Filter by TCP /UDP port numbers, OSI Layer 4, Layer 3 device

Looks at traffic, compares to a list of rules, then filters

Stateless FW- each packet individually examined, dosent keep track of sessios active, compares traffic to list of controls.

Stateful FW- Everhything within a valid flow is allowed, most are statful. allow traifficflows to be built, keeps track of active flows, when traffic passes thru fire wal the wall keeps track of it nd checks returning traffic on the session table

Application Aware devices- examine data in all packets

OSI Application layer , App layer gateway, deep packet inspection,

Network Based FW- control traffic flow based on application (Micrsoft SQL Twittwe,Youtube)

Intrusin Prevention Systems- Identify application,apply application specific vulnerability signatures to traffic

Host Based FW- already on a OS, can designte specific rules, knows what apps your using

ACL- Access control list. Group of variables t compare to traffic

Tuples- grouping of categories (Source IP, port number, Destinaion IP, Time of day, app, ect)

Implied deny- if traffic dosent match rules it is dropped

VPN Concentrators (encrytped tunnel between two points)

Cncentrator- encrytpion/decrytion access device, cn be built into FW ( sits infront of network, is one end of the tunnel, decrypts to push out into network

SSL VPN- TCP/43, almost no firewall issues, runs from a browers to a concentrator

Fulltunel- all traffic regardless ofdesitination, it will go through the tunnel

IPSec(Internet Protocol Security)- OSI layer 3 encryption from one site to the other, intgrty check to make sure no one is replaying traffic. Bc itis a common protocol it can be used with 2 different manufactures FWs. Two core protocols AH(authentication header) ESP (Encapsulation Security Payload)

Modes of comm:

Transport mode- (IP Header)(IPSec Header)(Data)(IPSec TRailers)

Tunnel Mode: (New IP Header)(IPsec Header)(IP Header) (DATA) (IPsec Trailers) - will not have anyy idea what the actual IP destiniation is is encryted

AH- will take IP header nd data combine with shared key and add to packet header. (Hash:MD5,SHA-1,SHA-2 re common)

ESP-provides encrytion, 3DES or AES for encryption, adds header, trailer and integrity check value

Seite 2

VPN concentrator- encryption& decrypton, can be built into firecall or soft ware, more than one person at a time can use it

Usually in front of a corperate network connected to internet. Traffic is sent from a client to the Corp Net via the concentrator, gets decrypted at cocentrator then goes into Network. For traffic leaving network, it get encrypted at concentrator, then sent back to original client via concentrator

SSL VPN- built into browes or OS, running from browers to concentrator.