Firewall Architecture Tutorial

Firewall implementation and design for an enterprise can be a daunting task. Choices made early in the design process can have far-reaching security implications for years to come. In this series of tips, we take a detailed look at the task of firewall implementation and help guide you through the design process.

We've divided the process into four stages:

• How to choose a firewall:
  Despite the development and evolution of next generation security technologies, the firewall remains a vital component of any network architecture. However, today's organizations have several types of firewalls to choose from. This tip outlines five basic questions to ask when identifying the type of firewall that best suits your organization's network security needs.
• Choosing the right firewall topology:
  When developing a perimeter protection strategy for an organization, one of the most common questions is "Where should I place firewalls for maximum effectiveness?" This tip provides an overview of the three most common firewall topologies, including diagrams of a bastion host, screened subnet and dual-firewall architectures.
• Placing systems in a firewall topology:
  Once you have decided which topology best suits your IT infrastructure, it's time to decide where to place individual firewall systems within the chosen topology. This tip reviews several factors to consider when deciding where to place systems in a firewall topology, such as bastion host, screened subnet and multi-homed firewalls.
• Auditing firewall activity:
  Firewall configurations change quickly and often, making it difficult to keep on top of routine firewall maintenance tasks. In this tip, learn ways to audit a firewall's capabilities to help keep network events in order.

Reading through each of these tips will put you well on the road to firewall implementation success. Good luck!

ABOUT THE AUTHOR:

Mike Chapple, CISSP is an IT Security Professional with the University of Notre Dame. He previously served as an information security researcher with the National Security Agency and the U.S. Air Force. Mike is a frequent contributor to SearchSecurity, a technical editor for Information Security magazine and the author of several information security titles including the CISSP Prep Guide and Information Security Illuminated.

Rate this Tip To rate tips, you must be a member of SearchSecurity.com. Register now to start rating these tips. Log in if you are already a member. Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Network Security Tactics Enterprise role management: Trends and best practices Using Nessus Attack Scripting Language (NASL) to find application vulnerabilities Screencast: Recovering lost data with WinHex How to build security into a virtualized server environment How to install and configure Nessus How to run a Nessus system scan Nessus: Vulnerability scanning in the enterprise Screencast: An introduction to the Open Source Security Testing Methodology Manual (OSSTMM) Understanding multifactor authentication features in IAM suites Network intrusion prevention systems: Should enterprises deploy now? DMZ A security checklist: How to build a solid DMZ What server considerations should be made when setting up an internal network's private applications? How is internal mail channeled through an enterprise firewall? Microsoft NAP-TNC compatibility won't speed adoption, users say How do a DMZ and VPN work together? What are the risks of placing enterprise users in a DMZ? Infrastructure security: Remote access DMZ How to configure and implement a DMZ Network Access Control Learning Guide Designing a DMZ using iptables Network Firewalls Is it possible to allow select access to IP addresses using Windows Server 2003? Sophos finds patching issues through endpoint NAC tool Fortinet acquires database vulnerability scanner from IPLocks Is an IPsec VPN necessary when connecting remote servers that process financial transactions? Embedding security has drawbacks says TippingPoint chief architect Is security improved when the number of Internet gateways is reduced? Nipper audits routers, reveals insecure settings Product review: Netgear's Netgear FVS336G ProSafe Dual WAN Gigabit Firewall Product review: Tufin's Tufin SecureTrack 4.1 Product review: SonicWALL's SonicWALL NSA E5500 RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary DMZ  (SearchSecurity.com) RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.