What are the disadvantages of proxy-based firewalls?

Network security expert Mike Chapple explains why he strongly recommends the use of proxy-based firewalls.

How do you overcome the disadvantages of proxy-based firewalls?

Proxy-based firewalls provide the most advanced firewall security technology currently available on the market. I use them myself and strongly recommend their use for protecting sensitive information, especially in public-facing Web applications.

Proxy firewalls function by acting as a true intermediary between the client and the server. Traditional stateful inspection firewalls simply analyze traffic to determine whether it should be allowed before passing it directly to the protected server. Proxy firewalls, on the other hand, actually establish connections with both the client and the server, allowing them to inject themselves into the connection stream. This provides them with the ability to perform deep application-layer inspection of traffic to identify application-level attacks, such as SQL injection exploits.

The main disadvantage to proxy-based firewalls is their cost. They are significantly more expensive than standard stateful inspection firewalls both in terms of actual financial cost and processing time used. The best way to compensate for this is to use the proxy features sparingly. If an application will not significantly benefit from proxy filtering, disable application filtering for that particular rule. This will help to squeeze maximum performance out of the firewall.

This was first published in June 2009

Dig Deeper on Network Firewalls, Routers and Switches



Find more PRO+ content and other member only offers, here.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.



Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: