Firewalls 101

Question 1

It is a device within a network responsible for determining what traffic is allowed to enter and exit.

Answer 1

Firewall

Question 2

Firewall Category

Answer 2

Stateful
Stateless

Question 4

This type of firewall uses the entire information from a connection; rather than inspecting an individual packet, this firewall determines the behaviour of a device based upon the entire connection.

This firewall type consumes many resources in comparison to stateless firewalls as the decision making is dynamic. For example, a firewall could allow the first parts of a TCP handshake that would later fail.

If a connection from a host is bad, it will block the entire device.

Answer 4

Stateful

Question 5

This firewall type uses a static set of rules to determine whether or not individual packets are acceptable or not. For example, a device sending a bad packet will not necessarily mean that the entire device is then blocked.

Whilst these firewalls use much fewer resources than alternatives, they are much dumber. For example, these firewalls are only effective as the rules that are defined within them. If a rule is not exactly matched, it is effectively useless.

However, these firewalls are great when receiving large amounts of traffic from a set of hosts (such as a Distributed Denial-of-Service attack)

Answer 5

Stateless

Question 6

What layers of the OSI model do firewalls operate at?

Answer 6

3 & 4

Question 7

What category of firewall inspects the entire connection?

Answer 7

stateful

Question 8

What category of firewall inspects individual packets?

Answer 8

stateless