Next generation (ng) firewalls
Download as PPTX, PDF•1 like•1,136 views
Next Generation (NG) firewalls address the complexity that arose from combining multiple security functions into standalone devices. NG firewalls integrate firewall, intrusion detection, VPN, application control, web proxy, antivirus, and identity awareness capabilities into a single high-performance device. This consolidation improves network throughput, resilience, cost efficiency, and troubleshooting by eliminating the problems caused by managing separate security appliances. NG firewalls can analyze traffic in real-time at speeds of 10 gigabits per second and implement flexible access policies based on users, groups, applications, times of day, and other advanced criteria.
![NG Firewalls
• Massively powerful switch/routers
• Massively powerful analysis engines
• Architected to analyse multiple of 10Gigabits of traffic in real-
time
• The type of access-list is entirely different
• Instead of:
• [IP Address A] can access [IP Address B] on [Port Y]
• We can write:
• [Users] in the [Finance Group] can access [Finance systems] during
[08.00 until 18.00]
• [All Students] on [IT Suite PCs] can only access [Social networking
sites] between [17.00 and 09.00]
• [Anyone] using [bittorrent] can only [upload] at [50kpbs]
• [Anyone] using [www] (if not previously known) must [authenticate]](https://image.slidesharecdn.com/nextgenerationngfirewalls-121220054045-phpapp01/85/Next-generation-ng-firewalls-5-320.jpg)
Next generation (ng) firewalls
- 1. Next Generation (NG) Firewalls • Firewall history • But what about??? • Complexity creep • NG firewalls
- 2. Firewall history • Routers • Access control lists (non-stateful) • Firewalls • Stateful firewalls appeared mid 90s • Fairly simple databases (state tables) • NAT/PAT complicates things (state tables + src & dst ports) • Work at Layer 4 in the OSI 7 layer model 3. Network (IP/ICMP) 4. Transport (host-to-host flow control TCP/UDP) • From wikipedia (sorry!): “Early attempts at producing firewalls operated at the Application Layer, which is the very top of the seven-layer OSI model. This method required exorbitant amounts of computing power and is rarely used in modern implementations.”
- 3. But what about??? • AKA functionality creep • Intrusion Detection/Prevention Systems • Virtual Private Networks (S2S, C2S) • Application control • Web Proxy • Anti-virus/malware • Identity awareness
- 4. Complexity creep • All separate devices – creates problems… • Network throughput • Resilience • Cost (Capital and Revenue) • Complexity • Troubleshooting • Down-time
- 5. NG Firewalls • Massively powerful switch/routers • Massively powerful analysis engines • Architected to analyse multiple of 10Gigabits of traffic in real- time • The type of access-list is entirely different • Instead of: • [IP Address A] can access [IP Address B] on [Port Y] • We can write: • [Users] in the [Finance Group] can access [Finance systems] during [08.00 until 18.00] • [All Students] on [IT Suite PCs] can only access [Social networking sites] between [17.00 and 09.00] • [Anyone] using [bittorrent] can only [upload] at [50kpbs] • [Anyone] using [www] (if not previously known) must [authenticate]