Re: RE: [fw-wiz] Layer 3-7 Firewall.

Date: 03/19/03

  • Next message: Perrymon, Josh L.: "RE: [fw-wiz] PIX split tunneling"
    From: <>
    To: "Ben Nagy" <>, <>, "'Firewall Wizards List'" <>
    Date: Wed, 19 Mar 2003 12:36:09 -0500

    An example of a true L7 aware firewall is the Symantec Enterprise Firewall. I tested ours against useage of WebDAV extensions this morning and got this message (using sam spade):

    03/19/03 12:31:28 Browsing
    Fetching ...
    OPTIONS / HTTP/1.1


    Connection: close

    User-Agent: Sam Spade 1.14

    HTTP/1.1 501 Not Implemented

    MIME-Version: 1.0

    Server: Simple, Secure Web Server 1.1

    Date: Wed, 19 Mar 2003 17:31:28 GMT

    Connection: close

    Content-Type: text/html

    <HEAD><TITLE>Firewall Error: Not Implemented</TITLE></HEAD>
    <H1>Not Implemented</H1>
    The method that your browser attempted to use is either not allowed by the
    firewall or unknown to the firewall.
    One of the following may be the reason for this error:
    <LI>Your browser attempted to perform an illegal operation,</LI>
    <LI>The form on the web page that was just executed contains an illegal <i>
    action</i>, or</LI>
    <LI>The firewall does not yet support the features required by the requested
    The request seen by the firewall was:
            OPTIONS / HTTP/1.1


    Connection: close

    User-Agent: Sam Spade 1.14


    It allows HTTP GET and POST without problem (but verifies that strings are in bounds etc.)

    Simple SPI only ensures that the traffic stream is valid TCP. Checkpoint has an extra module that validates HTTP to some extent, acting as a true application proxy, but many sites don't use it because it reduces speed.

    > From: "Ben Nagy" <>
    > Date: 2003/03/19 Wed AM 10:12:56 EST
    > To: <>,
    > "'Firewall Wizards List'" <>
    > Subject: RE: [fw-wiz] Layer 3-7 Firewall.
    > > -----Original Message-----
    > > From:
    > > [] On Behalf
    > > Of George J. Jahchan
    > [...]
    > > Is there a SPI firewall out there that is application-layer protocol
    > > aware?
    > Is there one that isn't?
    > (FTP can't work without layer 7 "awareness" for example)
    > Also, SPI is a Checkpoint word, and it is certainly L7 "aware" (whether
    > it uses this awareness to measurably increase security is another
    > question....)
    > Perhaps you could clarify exactly what you mean? I don't want to sound
    > glib, but the marketeers have made this kind of discussion treacherous
    > unless we all know that we're talking about exactly the same question.
    > ben
    > _______________________________________________
    > firewall-wizards mailing list

    firewall-wizards mailing list

  • Next message: Perrymon, Josh L.: "RE: [fw-wiz] PIX split tunneling"