Szerkesztő:LinguisticMystic/ru/безопасность/9

🔥 09.0. Module 09: Firewall Technologies Introduction

Firewalls are critical security devices that control network traffic based on predefined security rules. They protect networks from unauthorized access, cyber threats, and data breaches by filtering incoming and outgoing traffic.

---

🌟 1. Why Are Firewalls Important?

✅ Prevent Unauthorized Access: Blocks malicious connections and unauthorized users.
✅ Mitigate Cyber Threats: Protects against malware, hackers, and denial-of-service (DoS) attacks.
✅ Enforce Security Policies: Defines which applications, ports, and protocols are allowed.
✅ Improve Network Segmentation: Creates secure zones (DMZs, internal networks, etc.).
✅ Monitor & Log Traffic: Provides visibility into network activity and security threats.

---

🔑 2. Types of Firewalls

Firewall Type	Description	Example Usage
Packet-Filtering Firewall	Examines individual packets based on source, destination, port, and protocol.	Blocks or allows traffic based on ACLs (Access Control Lists).
Stateful Firewall	Tracks the state of active connections to allow only legitimate traffic.	Used in corporate networks for dynamic filtering.
Application Layer Firewall	Inspects traffic at the application level (e.g., HTTP, FTP, DNS).	Used to block malicious web traffic or filter web applications.
Next-Generation Firewall (NGFW)	Combines deep packet inspection (DPI), intrusion prevention (IPS), and malware protection.	Used in enterprise networks for advanced threat detection.
Proxy Firewall	Acts as an intermediary between clients and servers, hiding internal IP addresses.	Used to protect users from web-based threats.
Cloud-Based Firewall	Security-as-a-service that filters traffic before reaching internal networks.	Used in cloud deployments (e.g., AWS, Azure).

---

🛠️ 3. Firewall Deployment Methods

Deployment Model	Description	Example
Host-Based Firewall	Software-based firewall on an individual computer/server.	Windows Defender Firewall, Linux iptables.
Network Firewall	Hardware or virtual firewall protecting an entire network.	Cisco ASA, Palo Alto Networks, Fortinet.
Cloud Firewall	Firewall provided as a cloud-based service.	AWS Security Groups, Azure Firewall.
DMZ Firewall	Protects servers in a Demilitarized Zone (DMZ).	Web and email servers behind a firewall.

---

🔍 4. How Firewalls Work

Firewalls analyze and filter traffic based on:
- Source & Destination IP
- Port Numbers (TCP/UDP)
- Protocol (HTTP, SSH, FTP, ICMP, etc.)
- Packet Contents (Deep Packet Inspection - DPI)
- State of Connection (Stateful Filtering)

Firewalls compare traffic against rules and take action:
✔ ALLOW (Permit Traffic) – If the packet matches an approved rule.
❌ DENY (Block Traffic) – If the packet is unauthorized or a threat.

---

🛡️ 5. Firewall Rule Example (Basic ACL)

✅ Deny All Traffic Except Web Traffic (HTTP/HTTPS)

!
access-list 101 permit tcp any any eq 80
access-list 101 permit tcp any any eq 443
access-list 101 deny ip any any
!
interface GigabitEthernet0/1
 ip access-group 101 in
!

🔹 Allows only web traffic (port 80, 443) while blocking all other traffic.

---

✅ 6. Best Practices for Firewall Implementation

✔ Use a Stateful Firewall – Tracks active connections for better security.
✔ Implement a Least Privilege Policy – Allow only necessary services.
✔ Regularly Update Firewall Rules – Adapt to new security threats.
✔ Enable Logging & Monitoring – Detect suspicious activity in real-time.
✔ Use Multiple Firewall Layers – Combine network, host-based, and cloud firewalls.
✔ Test Firewall Rules Before Deployment – Avoid accidental disruptions.

---

🚀 Final Thoughts

Firewalls are essential for protecting networks from cyber threats. Whether packet-filtering, stateful, or NGFW, firewalls enforce security policies and safeguard sensitive data.

🔥 09.1. Secure Networks with Firewalls

Firewalls play a crucial role in securing networks by filtering traffic, enforcing security policies, and preventing cyber threats. They act as a barrier between trusted and untrusted networks, controlling who and what can access network resources.

---

🌟 1. Why Use Firewalls for Network Security?

✅ Prevent Unauthorized Access – Blocks unwanted traffic and hackers.
✅ Mitigate Cyber Threats – Protects against malware, DoS/DDoS attacks, and intrusion attempts.
✅ Enforce Security Policies – Controls traffic based on IP, port, and protocol rules.
✅ Enhance Network Segmentation – Isolates different network zones (LAN, DMZ, WAN).
✅ Monitor & Log Traffic – Provides visibility into suspicious activities.

---

🔑 2. Key Firewall Features

Feature	Description
Packet Filtering	Inspects packets based on source/destination IP, protocol, and ports.
Stateful Inspection	Tracks active connections and allows only legitimate return traffic.
Deep Packet Inspection (DPI)	Examines application-layer data for malware or threats.
Intrusion Prevention System (IPS)	Detects and blocks malicious traffic in real time.
Application Control	Restricts or allows traffic from specific applications (e.g., Skype, Facebook, VPNs).
Network Address Translation (NAT)	Hides internal IPs, preventing direct exposure to the internet.

---

🛠️ 3. Firewall Deployment Strategies

Firewall Type	Deployment Scenario
Network Perimeter Firewall	Protects internal networks from external threats (e.g., internet to LAN).
Internal Segmentation Firewall (ISFW)	Protects sensitive internal resources (e.g., servers, databases).
Cloud Firewall	Protects cloud-based infrastructure (e.g., AWS, Azure).
Next-Generation Firewall (NGFW)	Offers advanced security features like DPI, IPS, and malware protection.

---

🔥 4. Basic Firewall Rule Implementation

✅ 1. Block All Traffic Except Web Traffic (HTTP/HTTPS)

!
access-list 101 permit tcp any any eq 80
access-list 101 permit tcp any any eq 443
access-list 101 deny ip any any
!
interface GigabitEthernet0/1
 ip access-group 101 in
!

🔹 Allows only web browsing (HTTP, HTTPS) while blocking all other traffic.

---

✅ 2. Restrict SSH Access to a Trusted Admin IP (192.168.1.50)

!
access-list 110 permit tcp host 192.168.1.50 any eq 22
access-list 110 deny tcp any any eq 22
!
interface GigabitEthernet0/0
 ip access-group 110 in
!

🔹 Only 192.168.1.50 can access the device via SSH.

---

✅ 3. Block ICMP (Ping) Requests to Prevent Network Scanning

!
access-list 120 deny icmp any any
access-list 120 permit ip any any
!
interface GigabitEthernet0/2
 ip access-group 120 in
!

🔹 Prevents attackers from using ping (ICMP) to discover active hosts.

---

🔍 5. Firewall Traffic Monitoring and Logging

To monitor and analyze firewall rules and traffic:

✅ Check Firewall ACLs

show access-lists

✅ Monitor Active Firewall Sessions

show ip access-list

✅ Enable Logging for Denied Packets

access-list 130 deny ip any any log

🔹 Logs all blocked packets for security analysis.

---

✅ 6. Best Practices for Securing Networks with Firewalls

✔ Use Stateful Firewalls – Track active connections for better security.
✔ Follow a Least Privilege Model – Deny all by default and allow only required traffic.
✔ Implement Network Segmentation – Use firewalls to separate LAN, DMZ, and critical assets.
✔ Enable Intrusion Prevention (IPS) – Block malicious traffic automatically.
✔ Regularly Update Firewall Rules – Adjust policies based on new threats.
✔ Enable Logging and Alerts – Monitor traffic for suspicious activity.

---

🚀 Final Thoughts

Firewalls are essential for securing networks by filtering traffic, preventing intrusions, and enforcing access policies. Proper configuration ensures maximum security without disrupting legitimate traffic.

---

🔥 09.2. Firewalls in Network Design

Firewalls are critical components in modern network security architectures. They serve as the first line of defense by filtering traffic, enforcing access policies, and protecting networks from unauthorized access and cyber threats. In network design, firewalls are strategically placed to secure internal and external traffic flows.

---

🌟 1. Why Are Firewalls Essential in Network Design?

✅ Protects Network Perimeter – Blocks unauthorized access to the internal network.
✅ Traffic Filtering – Controls what traffic enters and exits the network.
✅ Prevents Cyber Attacks – Stops malware, DoS, and brute-force attacks.
✅ Enhances Network Segmentation – Separates sensitive areas (LAN, DMZ, WAN).
✅ Enforces Security Policies – Defines access rules based on IP, ports, and protocols.
✅ Monitors & Logs Traffic – Detects suspicious activities and security breaches.

---

🔑 2. Firewall Placement in Network Design

🔹 Common Firewall Deployment Scenarios:

Firewall Placement	Purpose	Example Usage
Perimeter Firewall (Edge Firewall)	Protects internal network from external threats (Internet).	ISP Router → Firewall → LAN
DMZ Firewall	Protects public-facing servers (e.g., web, email servers).	External users can access web services but not the internal LAN.
Internal Segmentation Firewall (ISFW)	Secures different internal zones (e.g., HR, Finance).	Prevents lateral movement in case of a breach.
Cloud Firewall	Protects cloud-based infrastructure and applications.	AWS Security Groups, Azure Firewall.
Host-Based Firewall	Protects individual devices (workstations, servers).	Windows Defender Firewall, Linux iptables.

---

🛠️ 3. Firewall Placement in a Network

✅ Example: Multi-Layer Firewall Design

   Internet
      │
[ISP Router]
      │
[Perimeter Firewall]  <---- Protects entire network
      │
[DMZ Firewall]  <---- Protects public-facing servers (Web, Email, DNS)
      │
[Internal Firewall]  <---- Secures LAN (HR, Finance, IT departments)
      │
[Endpoint Security]  <---- Host-based firewalls on workstations

🔹 Key Benefits:
- Perimeter Firewall → Stops external attacks.
- DMZ Firewall → Ensures public servers are protected.
- Internal Firewall → Prevents insider threats and lateral movement.
- Host-Based Firewall → Adds endpoint protection.

---

🔥 4. Firewall Rules for Secure Network Design

✅ 1. Block All Traffic Except Web Traffic (HTTP/HTTPS)

access-list 101 permit tcp any any eq 80
access-list 101 permit tcp any any eq 443
access-list 101 deny ip any any
interface GigabitEthernet0/1
 ip access-group 101 in

🔹 Only allows web traffic (HTTP/HTTPS).

---

✅ 2. Restrict SSH Access to Admins Only

access-list 110 permit tcp host 192.168.1.50 any eq 22
access-list 110 deny tcp any any eq 22
interface GigabitEthernet0/0
 ip access-group 110 in

🔹 Only 192.168.1.50 can SSH into the network.

---

✅ 3. Block ICMP (Ping) Requests to Prevent Network Scanning

access-list 120 deny icmp any any
access-list 120 permit ip any any
interface GigabitEthernet0/2
 ip access-group 120 in

🔹 Prevents attackers from using ping to discover active hosts.

---

🔍 5. Firewall Traffic Monitoring and Logging

✅ View Configured Firewall Rules

show access-lists

✅ Check Active Firewall Rules on Interfaces

show ip access-lists

✅ Enable Logging for Denied Packets

access-list 130 deny ip any any log

🔹 Records denied packets for security analysis.

---

✅ 6. Best Practices for Firewalls in Network Design

✔ Use a Layered Approach – Deploy multiple firewalls at different network levels.
✔ Apply the Least Privilege Model – Block all traffic by default, then allow only necessary services.
✔ Enable Intrusion Prevention (IPS) – Protect against malware and zero-day attacks.
✔ Use Stateful Firewalls – Allow only legitimate traffic based on connection states.
✔ Regularly Update Firewall Rules – Adjust policies based on evolving threats.
✔ Enable Logging & Alerts – Monitor traffic for suspicious activity.

---

🚀 Final Thoughts

Firewalls are critical components of network security. A well-designed firewall architecture ensures network protection, controlled traffic flow, and compliance with security policies.

🔥 09.3. Firewall Technologies Summary

Firewalls are essential security devices that protect networks by filtering traffic, enforcing security policies, and preventing cyber threats. They serve as the first line of defense against unauthorized access, malware, and attacks.

---

🌟 1. Why Are Firewalls Important?

✅ Network Security: Prevents unauthorized access to critical resources.
✅ Traffic Control: Filters packets based on IP, protocol, port, and application.
✅ Attack Prevention: Blocks malware, DoS/DDoS attacks, and unauthorized users.
✅ Network Segmentation: Isolates internal resources, DMZ, and external access.
✅ Logging & Monitoring: Tracks traffic patterns and security events.

---

🔑 2. Types of Firewalls

Firewall Type	Description	Example Use Case
Packet-Filtering Firewall	Examines packets based on IP, protocol, and port.	Blocks traffic at the network perimeter.
Stateful Firewall	Tracks active connections and allows only legitimate return traffic.	Used in enterprise networks to prevent unauthorized connections.
Application Layer Firewall	Inspects application-layer data for deep security checks.	Blocks malicious web traffic or unauthorized app usage.
Next-Generation Firewall (NGFW)	Combines deep packet inspection (DPI), intrusion prevention (IPS), and malware filtering.	Used in modern enterprises to counter advanced threats.
Proxy Firewall	Acts as an intermediary, hiding internal IPs from attackers.	Protects users from web-based threats.
Cloud Firewall	Security-as-a-Service that filters traffic before reaching the internal network.	Used in cloud environments (AWS, Azure, Google Cloud).

---

🔥 3. Firewall Deployment Models

Deployment Model	Purpose	Example
Perimeter Firewall	Protects the entire internal network from external threats.	ISP Router → Firewall → LAN
DMZ Firewall	Protects public-facing servers from attacks.	Web & email servers behind a firewall.
Internal Segmentation Firewall (ISFW)	Controls internal traffic between departments.	Isolates Finance, HR, and R&D teams.
Cloud Firewall	Secures cloud-based services and applications.	AWS Security Groups, Azure Firewall.
Host-Based Firewall	Protects individual devices and endpoints.	Windows Defender, Linux iptables.

---

🛠️ 4. Key Firewall Features & Rules

✅ Packet Filtering Rule Example: Block Telnet (Port 23)

access-list 101 deny tcp any any eq 23
access-list 101 permit ip any any
interface GigabitEthernet0/1
 ip access-group 101 in

🔹 Prevents unauthorized remote access via Telnet.

---

✅ Stateful Firewall Example: Allow Only Established Sessions

ip inspect name SECURE_FW tcp
ip inspect name SECURE_FW udp
interface GigabitEthernet0/1
 ip inspect SECURE_FW in

🔹 Ensures only return traffic from established connections is allowed.

---

✅ Next-Generation Firewall (NGFW) Features

✔ Deep Packet Inspection (DPI) – Scans traffic beyond header information.
✔ Intrusion Prevention System (IPS) – Detects and blocks suspicious activity.
✔ Malware Filtering – Identifies and blocks malware downloads.
✔ Application Control – Restricts access to specific applications (e.g., Facebook, VPNs).

---

🔍 5. Firewall Logging and Monitoring

✅ Check Active Firewall ACLs

show access-lists

✅ Monitor Traffic Matching an ACL

show ip access-lists

✅ Enable Logging for Denied Packets

access-list 130 deny ip any any log

🔹 Records all blocked packets for security auditing.

---

✅ 6. Best Practices for Firewall Implementation

✔ Deploy Firewalls at Key Network Locations – Edge, DMZ, Internal Segments.
✔ Use a Least Privilege Model – Block all traffic by default, then allow only needed services.
✔ Enable Intrusion Prevention (IPS) – Protect against zero-day threats.
✔ Regularly Update Firewall Rules – Adapt to new security threats.
✔ Enable Logging and Alerts – Monitor suspicious activity in real-time.
✔ Use Stateful Firewalls for Better Security – Track active connections.

---

🚀 Final Thoughts

Firewalls are essential for network security, access control, and threat prevention. By deploying the right type of firewall, organizations can protect sensitive data, enforce security policies, and prevent cyberattacks.