|
|
11.2 | |
Access Control Lists (ACLs) | |
| 11.2.5 | |
Firewalls |
|
A firewall is an architectural structure
that exists between the user and the outside world to protect the
internal network from intruders. In most circumstances, intruders come
from the global Internet and the thousands of remote networks that it
interconnects. Typically, a network firewall consists of several
different machines that work together to prevent unwanted and illegal
access. In this architecture, the router that is connected to the Internet, referred to as the exterior router, forces all incoming traffic to go to the application gateway. The router that is connected to the internal network, the interior router, accepts packets only from the application gateway. In effect, the gateway controls the delivery of network-based services both into and from the internal network. For example, only certain users might be allowed to communicate with the Internet, or only certain applications might be permitted to establish connections between an interior and exterior host. If the only application that is permitted is mail, then only mail packets should be allowed through the router. This protects the application gateway and avoids overwhelming it with packets that it would otherwise discard. ACLs should be used in firewall routers, which are often positioned between the internal network and an external network, such as the Internet. The firewall router provides a point of isolation so that the rest of the internal network structure is not affected. ACLs can be used on a router positioned between the two parts of the network to control traffic entering or exiting a specific part of the internal network. A configuration of ACLs on border routers, which are routers situated on the boundaries of the network, is necessary to provide security benefits. This provides basic security from the outside network, or from a less controlled area of the network, into a more private area of the network. On these border routers, ACLs can be created for each network protocol configured on the router interfaces.
|
Web Links