Re: [fw-wiz] Firewall best practices

On Fri, 23 Apr 2010, Martin Barry wrote:

$quoted_author = "Marcus J. Ranum" ;

That's why firewalls need to go back to doing what they
originally did, and parsing/analyzying the traffic that
flows through them, rather than "stateful packet
inspection" (which, as far as I can tell, means that
there's a state-table entry saying "I saw SYN!")

Marcus, are you referring to DPI or proxies or both or something else
entirely?


If the firewall doesn't understand the data it's passing,
it's not a firewall, it's a hub.

If an application emulates HTTPS traffic and is proxy aware, how do you tell
the difference?

There are firewalls on the market that can decrypt HTTPS traffic (and I believe be configured to block any traffic that they can't decrypt)

David Lang
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: [fw-wiz] Firewall best practices
    ... flows through them, rather than "stateful packet ... inspection" (which, as far as I can tell, means that ... If the firewall doesn't understand the data it's passing, ...
    (Firewall-Wizards)
  • Re: [fw-wiz] Firewall best practices
    ... That's why firewalls need to go back to doing what they ... flows through them, rather than "stateful packet ... inspection" (which, as far as I can tell, means that ...
    (Firewall-Wizards)
  • Re: What do you think of my acces list?
    ... These ACEs would not be necessary if you were using "inspection" on an internal interface to provision the return path (temporary dynamic holes in the firewall). ... " permit udp any eq domain any " ... If you were trying to accommodate DNS "responses" resulting from queries initiated by internal clients, I would have expected the generic UDP inspection to provision the return path for this return traffic. ...
    (comp.dcom.sys.cisco)
  • Re: [fw-wiz] Firewalls that generate new packets..
    ... depend upon either statelessness or guessing the next sequence ... than a "stateful" firewall. ... Is "deep packet inspection" stream inspection? ... I am not convinced that the vendors that are selling "deep packet ...
    (Firewall-Wizards)
  • Re: Firewall problem.
    ... I assume "mail flows" means in and out? ... are the firewalls you tested Windows Security aware - ie does the "you gotta firewall" component if Windows recognise their existence ... Checked Zonealarms permissions, and thunderbird had ...
    (microsoft.public.windowsxp.basics)