Question

You are the network security technician for a large shoe manufacturer based in Detroit, MI. Your internetwork connects six buildings through fiber links. You have experienced numerous attacks on your corporate Web server. The company CEO decides to pay for a firewall. Describe the filters you will implement in your firewall, and note how you will test your firewall.

Answer 1

Firewall allows a user to filter all incoming and outgoing traffic flowing through his network or system. It may use predefined or custom set rules to filter network traffic and to inspect it as it comes in or goes out. Various filtering can be implemented on the firewall in order to protect our network. Some are as following:

• Use of ACL (Access control List) to filter traffic based on layer 3 specifications. The user can block or filter http traffic coming from outside, by implementing an ACL, which will only allow the traffic from defined sources (i.e. IP addresses).

• QoS (Quality of Service) can be implemented to improve quality of certain traffic, by applying rate limiting, traffic policing and prioritizing of important traffic.

• To prevent DoS (Denial of Service) attacks, only definite number of half-open TCP sessions should be allowed.

• Use of REGEX allows filtering traffic based on the URL and the contents of the webpage. We can deny unwanted URL’s or potentially dangerous URL’s.

• Stateful firewall inspection can be implemented in order to allow on monitored traffic and deny any other traffic.

• Potentially dangerous host can be blocked using the ACL.

• Various alarms can be set that can alert the user in case of any unusual network activity.

• Any unused port should be blocked (Can allow only port 80(http) and 443(https)).

The best way to test the firewall if from the outside network (i.e. internet). Various Port Scanning tools can be used in order to check any open port that can be harmful. Many free tools and website allows the user to test the firewall. Help of Ethical hackers can be taken to check the security of the firewall.