| 8.1 |  | Introduction to Firewalls |
| 8.1.2 |  | Firewall technologies |

| Overview of firewall technologies Before discussing the specifics of the PIX Security Appliance, it is important to understand the basics of how firewalls operate. Firewalls rely on one of three technologies:

1. Packet filtering - Limits information into a network based on static packet header information
2. Proxy server - Requests connections between a client on the inside of the firewall and the Internet
3. Stateful packet filtering - Combines the best of packet filtering and proxy server technologies

This section examines each of these technologies.

Packet filtering
A firewall can use packet filtering to limit information entering a network or information moving from one segment of a network to another. Packet filtering uses access control lists (ACLs), which allow a firewall to accept or deny access based on packet types and other variables .

This method is effective when a protected network receives a packet from an unprotected network. Any packet that is sent to the protected network and does not fit the criteria defined by the ACLs is dropped.

However, there are problems with packet filtering:

- Arbitrary but undesirable packets can be sent that fit the ACL criteria and, therefore, pass through the filter.
- Packets can pass through the filter by being fragmented.
- Complex ACLs are difficult to implement and maintain correctly.
- Some services cannot be filtered.

Proxy server
A proxy server is a firewall device that examines packets at higher layers, Layers 4 through 7, of the Open Systems Interconnection (OSI) model. This device hides valuable data by requiring users to communicate with a secure system by means of a proxy. Users gain access to the network by going through a process that establishes session state, user authentication, and authorized policy. This means that users connect to outside services by way of application programs, or proxies, running on the gateway connecting to the outside, unprotected zone .

However, there are problems with proxy servers due to the following factors:

- They create single points of failure, which means that if the entrance to the network is compromised, then the entire network is compromised.
- They make it difficult to add new services to the firewall.
- They are CPU intensive and often perform slower under stress.

Stateful packet filtering
Stateful packet filtering is the method used by the Cisco PIX Security Appliance . This technology maintains the complete session state. Each time a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) connection is established for inbound or outbound connections, the information is logged in a stateful session flow table. This table contains the source and destination addresses, port numbers, TCP sequencing information, and additional flags for each TCP or UDP connection associated with a given session. This information creates a connection object. Consequently, all inbound and outbound packets are compared against the session flows listed in the stateful session flow table. Data is permitted through the firewall only if an appropriate connection exists to validate its passage.

This method is effective because of the following reasons:

- It works on packets and connections.
- It operates at a higher performance level than packet filtering or using a proxy server.
- It records data in a table for every connection or connectionless transaction. This table serves as a reference point to determine if packets belong to an existing connection or are from an unauthorized source.