User Manual Part 1

The Safe@Office Firewall
Chapter 2: Safe@Office Security 37
The Safe@Office Firewall
What Is a Firewall?
The most effective way to secure an Internet link is to put a firewall between the local
network and the Internet. A firewall is a system designed to prevent unauthorized access to
or from a secured network. Firewalls act as locked doors between internal and external
networks: data that meets certain requirements is allowed through, while unauthorized data
is not.
To provide robust security, a firewall must track and control the flow of communication
passing through it. To reach control decisions for TCP/IP-based services, (such as whether
to accept, reject, authenticate, encrypt, and/or log communication attempts), a firewall
must obtain, store, retrieve, and manipulate information derived from all communication
layers and other applications.
Security Requirements
In order to make control decisions for new communication attempts, it is not sufficient for
the firewall to examine packets in isolation. Depending upon the communication attempt,
both the communication state (derived from past communications) and the application state
(derived from other applications) may be critical in the control decision. Thus, to ensure
the highest level of security, a firewall must be capable of accessing, analyzing, and
utilizing the following:
• Communication information - Information from all seven layers in the packet
• Communication-derived state - The state derived from previous communications.
For example, the outgoing PORT command of an FTP session could be saved so
that an incoming FTP data connection can be verified against it.
• Application-derived state - The state information derived from other applications.
For example, a previously authenticated user would be allowed access through
the firewall for authorized services only.
• Information manipulation - The ability to perform logical or arithmetic functions
on data in any part of the packet. For example, the ability to encrypt packets.