Re: [fw-wiz] Firewalls that generate new packets..

I believe this goes into the "proxies rawk" folder alongside my posts.

I really would like to see a thorough analysis of the performance of an application layer policy enforcement using strictly stateful inspection
techniques versus the same policy enforced using strictly proxy techniques. I am not certain this could be done using any COTS firewalls today b/c the implementations have blurred the distinctions (my opinion). But perhaps that's good b/c people are paying less attention to the rhetoric and posturing than they did 10 years ago.


Patrick M. Hausen wrote:
Hello,

On Fri, Nov 23, 2007 at 05:07:23PM -0500, Paul D. Robertson wrote:
On Mon, 19 Nov 2007, Paul Melson wrote:

and has a miniscule share of the total firewall market. Of course, Cisco,
Check Point, and most of their competitors have proxies. Proxy firewalls
are dead. Long live proxy firewalls.
But if my experience with Internet-enabled software vendors is anywhere near common, nobody's enablign the proxies.

Absolutely correct. Because at least for one of these vendors
the proxies are riddled with bugs, i.e. protocol violations or,
to the customer, arbitrary restrictions, and, additionally,
performance plummets faster than <insert favorite comparison>.

These proxies are (IMHO) just a check item for people who buy
products based on check lists.

You need to design a firewall for use of proxies as your main
line of defense from the ground up. Fortunately current CPU
speeds and RAM capacities show the "stateful packet filters
are faster" argument not to be true anymore. At least not
if implemented on general purpose hardware.

The product with the "miniscule share of the total firewall market"
can easily support Gigabit speeds.

Of course I'm biased, but I happen to have a customer with
about 14.000 seats running both Checkpoint and Secure Computing.
You should talk to their IT staff.

They introduced Checkpoint firewalls when your "high end" ALG
was Gauntlet on a Sun E450. A current Sidewinder runs circles
around these boxes. With much more thorough protocol inspection
than Gauntlet ever had. Sorry, ^inspection^enforcement. ;-)

Kind regards,
Patrick M. Hausen
Leiter Netzwerke und Sicherheit
begin:vcard
fn:David Piscitello
n:Piscitello;David
adr;dom:;;3 Myrtle Bank Lane;Hilton Head;SC;29926
email;internet:dave@xxxxxxxxxxx
x-mozilla-html:FALSE
url:http://hhi.corecom.com/weblogindex.htm
version:2.1
end:vcard

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: operationg system firewall question
    ... They may or may not add proxies on top. ... In general Windows based firewalls are easiest for most to ... For most a hardware device seems to be the best solution. ...
    (comp.security.firewalls)
  • Re: Server push
    ... > the connection bar to ensure that the requested action is still valid. ... if you really want to reproduce server push you will need an activex ... > a lot of firewalls and proxies will stamp all over this and time the ...
    (comp.lang.php)
  • Re: [fw-wiz] Firewalls that generate new packets..
    ... and most of their competitors have proxies. ... Long live proxy firewalls. ... But if my experience with Internet-enabled software vendors is anywhere ...
    (Firewall-Wizards)
  • Re: [fw-wiz] IPS vs. Firewalls (why vs. ?)
    ... Actually, two of the other firewalls I have lying on the floor in my office have at least two of the three, and I suspect that one really does have a proxy but the marketing people don't want anyone to know about it. ... I don't think the traditional arguments over proxy vs. DPI, signatures vs. NBS, etc. are all that relevant nor interesting. ... Proxies get the job done in a lot more situations than they are given credit for, ... There are situations where IPS may indeed provide relief from certain classes of attacks. ...
    (Firewall-Wizards)
  • Re: [fw-wiz] Firewalls that generate new packets..
    ... On Mon, 19 Nov 2007, Paul Melson wrote: ... and most of their competitors have proxies. ... Long live proxy firewalls. ...
    (Firewall-Wizards)