Question

You want to use a packet firewall to protect the Hospital network but you are hesitant to choose the right location among the following: putting it on the web server at DMZ, putting it along with the IDS server, putting it on the screened subnet with DMZ, or putting it on the domain boundary. Recommend the right answer with justification as to why or why not.

Answer 1

A packet firewall should be placed at the domain boundary, as it filters packets based on source and destination IP address, and source and destination port. It does not monitor the traffic itself, only peering into the headers to check that packets are coming from an approved source and going towards the appropriate destination. Thus, as long as the source is correct, it does not matter if the content is malicious. It is a very simple filtering algorithm, and thus is very fast as it does not need to make many logical decisions. The best place for it would be at the very boundary of the domain, ensure the fast approval of IP packets coming from the right source.