What is Firewall?

WHAT IS FIREWALL ?
If you have more than one computer connected in the home, or if you have a small-office network, it is important to protect every computer. You should have a hardware firewall (such as a router) to protect your network, but you should also use a software firewall on each computer to help prevent the spread of a virus in your network if one of the computers becomes infected.

But when we deal with Networking, the Definition of Firewall changes as below

• Firewall is a product which creates segments in the network based on Security requirements.
• In Simple words it divides the network into different Spaces.
• Segments can either be L2 or L3 depending upon the requirement.

Firewall divides the network into multiple Security Segment and then creates policies to allow Traffic from one Segment to another.

• Switch creates Segments on L2 Network, While Router on L3 and Firewall creates Segmentation on L2 & L3 both.
• It creates 2 Segments (Private Network & Public Network)
• Private Network is the inside Network which is trusted Network, protected from outside World.
• Public Network is the outside Network which is treated as Untrusted Network.

   
Inside Network (Trusted Network)------>>>>Firewall----->>>Outside Network (UnTrusted Network)

                     

ASA Firewall and its Types

ASA Firewalls are divided into following types depending on its functionality

• ASA 5505 (simplest and earliest version)
• ASA 5510
• ASA 5520
• ASA 5550

ASA 5505

• ASA 5505 has limitation in terms of users. IT can have 10, 50 or unlimited users.
• It has maximum throughput of 150Mbps.
• It has 3DES/AES/VPN throughput upto 100Mbps.
• It can have around 10-20 VPN Peers.
• It can have around 10k-25k concurrent connections, with 4k new connections.
• It supports 8-port Fast Ethernet Switch (including 2POE ports)
• It supports 3 VLAN Interfaces.

ASA 5510

• ASA 5510 has unlimited users support.
• It has maximum throughput of around 300Mbps.
• It has 3DES/AES/VPN throughput upto 170Mbps.
• It can have around 250 VPN Peers.
• It can have around 50k-130k concurrent connections, with 9k new connections.
• It supports 5-port  Switch (including 2-Gigabit Ethernet port and 3-Fast Ethernet Ports)
• It supports 50 VLAN Interfaces.

ASA 5520

• ASA 5520 has unlimited users support.
• t has maximum throughput of around 450Mbps.
• It has 3DES/AES/VPN throughput upto 225Mbps.
• It can have around 750 VPN Peers.
• It can have around 280k concurrent connections, with 12k new connections.
• It supports 5-port  Switch (including 4-Gigabit Ethernet port and 1-Fast Ethernet Ports).
• It supports 150 VLAN Interfaces.

ASA 5540

• ASA 5540 has unlimited users support.
• It has maximum throughput of around 650 Mbps.
• It has 3DES/AES/VPN throughput upto 325 Mbps.
• It can have around 5K VPN Peers.
• It can have around 400k concurrent connections, with 25k new connections.
• It supports 5-port  Switch (including 4-Gigabit Ethernet port and 1-Fast Ethernet Ports).
• It supports 200 VLAN Interfaces.

ASA 5550

• ASA 5550 has unlimited users support.
• It has maximum throughput of around 1.2 Gbps.
• It has 3DES/AES/VPN throughput upto 425 Mbps.
• It can have around 5K VPN Peers.
• It can have around 650k concurrent connections, with 33k new connections.
• It supports  8-Gigabit Ethernet port, 4-SFP Fiber and 1-Fast Ethernet Ports).
• It supports 400 VLAN Interfaces.

ASA Firewall History

What is ASA?

ASA stands for Adaptive Security Appliance.
ASA is a security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities. It provides proactive threat defense that stops attacks before they spread through the network.

ASA is valuable and flexible in that it can be used as a security solution for both small and large networks

History of Firewall

• Cisco First Introduced PIX Firewall in year 1999.
• Later ASA Firewall was introduced as an Advanced version of PIX in the year 2005/06.
• Cisco further added ASA-X Series in the year 2012, which brought about more advanced features in Firewall.

ASA Firewall are of different types depending on its features and capabilities
 ASA Firewall and its Types

Need for NAT & Its Pros and Cons

NAT is Network Address Translation, For basic details about it refer the link NAT Overview
NEED for NAT

The major need for introducing NAT was exhausting IP Address, though it also got the Identity of Securing the Internal Private Network. The Private IP Address was hidden inside Th outside Public Address.

It Also Served the purpose of Private IP Address not routable into Internet, so they are translated to Public IP through NATing 

Advantages of NAT

•  Securing the Internal Private IP from outside world. So that Attacker wont be able to track Internal IP.

• Reusing Private IPs again and again at different local networks can be possible because of NAT. Hence Preserving depletion of IPv4 Addresses

• NAT helps in preventing internal Address Change if you change the Service Provider.

Disadvantages Of  NAT

• NAT  is a processor and memory resource consuming technology, since NAT need to translate IPv4 addresses for all incoming and outgoing IPv4 datagrams and to keep the translation details in memory.

• NAT  may cause delay in IPv4 communication.

• NAT cause loss of end-device to end-device IP traceability.

• Also Some Applications and Technologies will not function as expected in NAT.

Host A-----Inside IP Address----NAT----Outside IP Address-----Internet

Host A----Private (Local IP)-----NAT-----Public (Global IP)--------Internet

NAT- Network Address Translation and Types of IP Address

In Todays Growing Networking World, there are increasing number of devices in a network. Each device is recognized by its Identical IP Address. Also the IP address division as Public and Private IP exhausting the future IP limit.

This placed the need for NAT (Network Address Translation) 

Network Address Translation What it does is, it translates the Private IP address to single Public IP.

Now the question arises what great it does by converting Private IP to Public IP???

For that you must know what is Private IP and Public IP First....

What is private IP address?

A private IP address is the address space allocated by user to allow organizations to create their own private network. There are three IP blocks (1 class A, 1 class B and 1 class C) reserved for a private use. The computers, tablets and smartphones sitting behind your home, and the personal computers within an organizations are usually assigned private IP addresses. A network printer residing in your home is assigned a private address so that only your family can print to your local printer.

When a computer is assigned a private IP address, the local devices sees this computer via it's private IP address. However, the devices residing outside of your local network cannot directly communicate via the private IP address, but uses your router's public IP address to communicate. To allow direct access to a local device which is assigned a private IP address, a Network Address Translator (NAT) should be used.

What is public IP address?

A public IP address is the address that is assigned to a computing device to allow direct access over the Internet. A web server, email server and any server device directly accessible from the Internet are candidate for a public IP address. A public IP address is globally unique, and can only be assigned to an unique device.

ACLs in Depth continued

Why use ACLs

*   Limits network traffic to increase network performance.

*   ACLs provides traffic flow control by restricting the delivery of routing updates.

*   It can be used as additional security.

*   Controls which type of traffic are forwarded or blocked by the router.

*   Ability to control which areas a client access.

Types of Access Control Lists

Standard access-list

• Standard access lists create filters based on source addresses and are used for server based filtering.
• Address based access lists distinguish routes on a network you want to control by using network address number (IP). 
• Address-based access lists consist of a list of addresses or address ranges and a statement as to whether access to or from that address is permitted or denied.

Example of the command syntax for configuring a standard numbered IP ACL:

R1(config)# access-list {1-99} {permit | deny} source-addr [source-wildcard]

•  The first value {1-99} specifies the standard ACL number range.

• The second value specifies whether to permit or deny the configured source IP address traffic.

•  The third value is the source IP address that must be matched.

•  The fourth value is the wildcard mask to be applied to the previously configured IP address to indicate the range.

 

Extended access lists

• Extended access lists create filters based on source addresses, destination addresses, protocol, port number and other features and are used for packet based filtering for packets that traverse the network.

Example of the command syntax for configuring an extended numbered IP ACL:

 Router(config)# access-list {100-199} {permit | deny} protocol source-addr [source-wildcard] [operator operand] destination-addr [destination-wildcard] [operator operand] [established]

• Like the standard ACLs, the first value {100-199 or 2000 - 2699} specifies the ACL number range.

• The next value specifies whether to permit or deny according to the criteria that follows.

• The third value specifies protocol type ( IP, TCP, UDP, or other specific IP sub-protocols). The source IP address and wildcard mask determine traffic source. The destination IP address and its wildcard mask are used to indicate the final destination of the network traffic. When the destination IP address and mask are configured, the port number  must be specified to match, either by number or by a well-known port name, otherwise all traffic to that destination will be dropped.

Standard and Extended access lists can be applied base on the use of ip access-list command.

Access lists use the deny or permit statement to define which packet is allowed or denied entry into a server or network.

Masks

• Masks are used with IP addresses in IP ACLs to specify what should be permitted and denied. Masks in order to configure IP addresses on interfaces start with 255 and have the large values on the left side, for example, IP address 172.16.2.14 with a 255.255.255.0 mask. Masks for IP ACLs are the reverse, for example, mask 0.0.0.255. This is sometimes called an inverse mask or a wildcard mask. When the value of the mask is broken down into binary (0s and 1s), the results determine which address bits are to be considered in processing the traffic. A 0 indicates that the address bits must be considered (exact match); a 1 in the mask is a "no".

Note these ACL equivalents.

• The source/source-wildcard of 0.0.0.0/255.255.255.255 means "any".

• The source/wildcard of 10.1.1.2/0.0.0.0 is the same as "host 10.1.1.2".

• If you subtract 255.255.255.0 (normal mask) from 255.255.255.255, it yields 0.0.0.255.

• The command below defines an ACL that permits this network 192.168.1.0 0.0.0.255.

access-list acl_permit permit ip 192.168.1.0 0.0.0.255

• Inbound traffic to the router is compared to access lists entries based on the order that the entries occur in the router. The router looks through the entries until it has a match. If the router found no match when it reaches the end of the list, the traffic is denied. For this reason, you should have the frequently hit entries at the top of the list. There is an implied deny for traffic that is not permitted. Single-entry access lists with only one deny entry has the effect of denying all traffic. You must have at least one permit statement in an ACL or all traffic is blocked.
• Access lists implicitly deny all access that is not expressly permitted. The following line is auto-appended to all access-lists:

deny ip any any

• If it is desirable to over-ride this implicit denial statement, enter a permit ip any any statement as the last entry in the access-list.

Access Control Lists in details

Access Control Lists (ACLs). 

• Access Control List (ACL) are filters that enable you to control which routing updates or packets are permitted or denied in or out of a network. They are specifically used by network administrators to filter traffic and to provide extra security for their networks. 
• This can be applied on routers (Cisco).

• ACLs provide a powerful way to control traffic into and out of your network; this control can be as simple as permitting or denying network hosts or addresses.  You can configure ACLs for all routed network protocols.

• The most important reason to configure ACLs is to provide security for your network. However, ACLs can also be configured to control network traffic based on the TCP port being used.

 How ACLs works.

• A router acts as a packet filter when it forwards or denies packets according to filtering rules. As a Layer 3 device, a packet-filtering router uses rules to determine whether to permit or deny traffic based on source and destination IP addresses, source port and destination port, and the protocol of the packet. These rules are defined using access control lists or ACLs.

• To simplify how ACL or a router uses packet filtering work, imagine  a guard stationed at a locked door. The guard's instruction is to allow only people whose names appear on a quest list to pass through the door. The guard is filtering people based on the condition of having their names on the authorized list.

• When a packet arrives at the router, the router extracts certain information from the packet header and makes decisions according to the filter rules as to whether the packet can pass through or be dropped. Packet filtering process works at the Network layer of the Open Systems Interconnection (OSI) model, or the Internet layer of TCP/IP.