Introduction Part 1 Introduction to Firewalls3 Chapter 1 Introduction to Firewalls What Is a Firewall? What Can Firewalls Do? Firewalls Manage and Control Network Traffic Firewalls Authenticate Access Firewalls Act as an Intermediary Firewalls Protect Resources Firewalls Record and Report on Events What Are the Threats? Targeted Versus Untargeted Attacks Viruses, Worms, and Trojans Malicious Content and Malware Denial of Service Zombies Compromise of Personal Information and Spyware Social Engineering New Attack Vectors Insecure/Poorly Designed Applications What Are the Motives? Security Policies Examples of Security Policies Firewalls and Trust Determining If You Need a Firewall Summary Chapter 2 Firewall Basics Firewall Taxonomy Personal Firewalls Network Firewalls Firewall Products Software Firewalls Appliance Firewalls Integrated Firewalls Firewall Technologies Personal Firewalls Packet Filters NAT Firewalls Circuit-Level Firewalls Proxy Firewalls Stateful Firewalls Transparent Firewalls Virtual Firewalls Open and Closed Source Firewalls Summary Chapter 3 TCP/IP for Firewalls Protocols, Services, and Applications The OSI Model The Department of Defense (DoD) Model How Firewalls Use Protocols, Applications, and Services Internet Protocol (IP) IP Packet Structure The IP Packet Header Bad IP Packets Transmission Control Protocol (TCP) TCP Segment Structure TCP Segment Header Bad TCP User Datagram Protocol (UDP) UDP Message Structure UDP Datagram Header Bad UDP Internet Control Message Protocol (ICMP) ICMP Message Structure Bad ICMP Addressing in IP Networks Physical Addresses Logical Addresses IP Addressing Subnets IPv6 Network Address Translation (NAT) NAT Implementations NAT and IPsec: The Issues and the Solutions Broadcast and Multicast IP Services IP Routing Types of Routing How the IP Routing Process Works Different Classes of Routing Protocols Common Routing Protocols Applications Using IP Common Applications Using IP Less-Common Applications Using IP Protocols Used to Implement Security Summary Part II How Firewalls Work Chapter 4 Personal Firewalls: Windows Firewall and Trend Micro''s PC-cillin Windows Firewall and Windows XP How Windows Firewall Works Configuring Windows Firewall Windows Firewall Features Windows Firewall Checklist Trend Micro''s PC-cillin Firewall Feature PC-cillin Requirements How the Trend Micro Firewall Works Configuring the Trend Micro Firewall Trend Micro Firewall Features Trend Micro Firewall Checklist Summary Chapter 5 Broadband Routers and Firewalls How Broadband Routers and Firewalls Work Linksys Broadband Routers/Firewalls Security and Filtering Features Routing Features Management and Administration Features Miscellaneous Features Linksys Requirements How the Linksys Router/Firewall Works Filtering Traffic from External Sources Filtering Traffic from Internal Sources Configuring Linksys Configuring Basic Setup Configuring Security Configuring Applications & Gaming Configuring Administration Linksys Checklist Summary Chapter 6 Cisco PIX Firewall and ASA Security Appliance PIX/ASA Features Choosing Between the PIX and the ASA Cisco PIX Firewall and ASA Models SOHO Solution Medium- to Large-Office Solution Enterprise Office and Service Provider Solution How the PIX/ASA Firewall Works Firewall Security Policy Firewall Modes of Operation Stateful Inspection Configuring the Cisco PIX/ASA Assigning IP Addresses to the Firewall Interfaces Configuring the Firewall Name, Domain Name, and Passwords Configuring the Firewall Routing Settings Configuring the Firewall for Remote Management Access Configuring NAT Settings for Outbound Access Configuring the ACLs Configuring Logging on the Firewall PIX/ASA Checklist Summary Chapter 7 Linux-Based Firewalls NetFilter Features NetFilter Requirements How NetFilter Works Configuring NetFilter IPTables Command-Line Tool Firewall Builder Firestarter Webmin NetFilter Checklist Summary Chapter 8 Application Proxy Firewalls Application Layer Filtering How Application Filtering Works The Difference Between Application Filtering and Deep Packet Inspection Proxy Server Functionality Limitations of Application Proxy Firewalls Microsoft ISA Server 2004 Firewall Microsoft ISA Server 2004 Features Microsoft ISA Server 2004 Requirements and Preparation How the Microsoft ISA Server 2004 Firewall Works Microsoft ISA Server 2004 Checklist Summary Chapter 9 Where Firewalls Fit in a Network Different Types of Office Requirements Central Office Remote Office Single-Firewall Architectures Internet Firewall with a Single DMZ Internet Firewall with Multiple DMZs Internet-Screening Firewall (No DMZ) Dual-Firewall Architecture The Firewall System Single-Firewall System Dual-Firewall System Where Personal/Desktop Firewalls Fit in a Network Where Application Firewalls Fit in a Network Firewalls and VLANs Virtual Firewalls Using Firewalls to Segment Internal Resources Protecting Sensitive Internal Resources Protecting from WAN or Remote-Access Requests Protecting Individual Internal Resources Be Realistic When Implementing Internal Firewalls High-Availability Firewall Designs Summary Part III Managing and Maintaining Firewalls Chapter 10 Firewall Security Policies Written Security Policies The Difference Between Policies, Standards, Guidelines, and Procedures Security Policy Format Common Security Policies Firewall Security Policy Firewall Policies/Rulesets Ingress Filters Egress Filters Management-Access Ruleset Summary Chapter 11 Managing Firewalls Default Passwords Maintaining the Underlying Platform Firewall Management Interface Managing Firewalls with a CLI Managing Firewalls with a GUI Interface Preference Management Access In-Band Management Out-of-Band Management Telnet vs. SSH HTTP vs. HTTPS Common Firewall Management Tasks Initial Configuration Modifying the Configuration Updating the Firewall Software Summary Chapter 12 What Is My Firewall Telling Me? Firewalls and Logging The Syslog Protocol Proprietary Logging Methods Why Logging Is Important Firewall Log Review and Analysis What to Look for in Firewall Logs Cisco Secure PIX Firewall Syslog Event Baseline Firewall Forensics The Value (or Not) of IP Addresses Deciphering Port Numbers Securing the Firewall Summary Chapter 13 Troubleshooting Firewalls Developing a Troubleshooting Checklist Step 1: Verify the Problem Reported Step 2: Test Connectivity Step 3: Physically Check the Firewall Step 4: Check for Recent Changes Step 5: Check the Firewall Logs for Errors Step 6: Verify the Firewall Configuration Step 7: Verify the Firewall Ruleset Step 8: Verify That Any Dependent, Non-Firewall-Specific Systems Are Not the Culprit Step 9: Monitor the Network Traffic Basic Firewall Troubleshooting Troubleshooting Connectivity Through the Firewall Troubleshooting Connectivity to the Firewall Advanced Firewall Troubleshooting Troubleshooting Example Summary Chapter 14 Going Beyond Basic Firewall Features Content Filtering Implementing a URL Filter Maintaining URL Filters What to Do If. Performing Application Filtering Applications That Are Hard to Firewall Intrusion Detection and Prevention Overview of IDS Virtual Private Networks IPsec VPNs SSL VPNs Summary Endnotes Part IV Appendixes Appendix A Firewall and Security Tools Appendix B Firewall and Security Resources 1587052210TOC052206.