Instructor: While routers can use Access Control Lists
to provide some protection filtering for our networks,
it's really a dedicated device known as a firewall
that excels at using Access Control Lists.
Now, Access Control Lists are very important for us
to be able to secure our networks
from unwanted traffic.
A large portion of the permit
and deny statements that we utilize in our ACLs
are based on port numbers, because these directly correlate
with an application or service that we wish to allow,
or to block.
Access Control List, or ACLs are the rule sets
that are placed on the firewalls, routers,
and other network infrastructure devices that permit
or allow traffic through a particular interface.
These rule sets will control the flow
of traffic into or out of our networks.
Now, to configure the Access Control List on our firewalls,
we're either going to be using a web-based interface,
or a text-based command line interface.
When configuring these ACLs,
it's important to remember that the order in which
they're listed specifies the order of the actions
that are taken on a particular piece of traffic.
Actions are always performed top down inside
of an Access Control List.
The traffic is compared against the first rule,
and if it matches the conditions for the action
to be applied, it's going to be performed,
and no other ACLs will be checked.
For this reason,
our most specific rules should always be placed
at the top of the list,
with more generic rules located towards the bottom.
Now, routers can provide basic security using
these Access Control Lists and filtering rules.
But it is really our network firewalls that are
most commonly going to be used
for network security and bulk blocking and allowing.
Firewalls can be hardware-based appliances,
or specialized software installed on a client or server,
to perform this function.
The primary role of a firewall is to inspect
and control traffic trying to enter
or leave a network's boundary.
There are many different types of firewalls,
including packet-filtering, stateful, proxy,
dynamic packet filtering, and kernel proxy firewalls.
Each type of firewall is going to focus on either a more
or less thorough inspection of the traffic.
As with everything in network security, there is going to be
a performance trade off based upon how deep
of an inspection we do.
If a firewall does a more in depth inspection,
then the device can achieve as high of a throughput,
because it's going to take more time to go through every one
of those ACL rules, and inspect each of those packets.
This can negatively affect our network's efficiency
and increase the network latency.
Now, because firewalls are such integral security devices
for our networks, they are constantly being evolved
to provide us with better features and more security.
It's important to note that many organizations
have been migrating towards
a Unified Threat Management firewall, or UTM.
Unified Threat Management devices provide the ability
to conduct numerous security functions within
a single device or network appliance.
These devices include the functionality
of multiple specialized devices, such as network firewalls,
network intrusion prevention systems, gateway antivirus
and anti-spam, virtual private network concentration,
content filtering, load balancing, and data loss prevention,
all within a single network appliance.
These Unified Threat Management devices have
a lot of benefits as well,
such as reducing the number of devices
that technicians need to learn, operate, and maintain.
This can help to decrease the overall cost
of providing these protections,
but there's still going to be some drawbacks here.
The largest issue
with UTM devices, is that they're a single point of failure.
If the device fails, for example,
we don't just lose our firewall anymore.
We're now losing our firewall, our antivirus,
our intrusion prevention system, and things like that.
All of our security stack can be wrapped up
in this one device, which means, if we lose it,
we lose our entire security stack.
So, our organization needs to consider
both the advantages and disadvantages
of Unified Threat Management before deciding to implement
that in our architecture.
Some advantages of using a UTM include lower upfront costs,
maintenance, and power consumption.
Because all of these functions reside
in a single rack-mounted device.
They're also going to be easier to install and configure,
than having to do multiple devices for each single function.
And they can be fully integrated,
which has a lot of benefits too.
The big disadvantage here is that they are
a single point of failure,
and they often lack the detail provided by
a more specialized tool,
and their performance can oftentimes not be as efficient
as a single function device would.
While UTM devices work well for the most part,
they do utilize separate individual engines
for each function they're trying to perform
in their security inspections.
Whereas, when you're using a next-gen firewall,
you're going to be using a single more efficient engine.
And so if network speed
and efficiency are your primary concern
for your organization,
you want to consider using a next-gen firewall
over a Unified Threat Management device.
Now, if your organization decides to go
with a Unified Threat Management device,
you're going to place it in between your LAN
and the connection to the internet,
just as if it was a firewall in an inline configuration.
As you can see, there are a lot of different choices
when it comes to firewalls when you're designing
the architecture of your network.