Firewall designs

There are different firewall design architectures that can be implemented based on the specific needs and network requirements. Here are a few common firewall designs:

1. Single Firewall: In this design, a single firewall is placed at the network perimeter, acting as the primary gateway between the internal network and the external network (usually the Internet). All incoming and outgoing traffic passes through this firewall, which applies access control rules to filter and manage the traffic.
2. Dual Firewall (DMZ): A dual firewall design involves the use of two firewalls: one at the network perimeter and another between the internal network and a demilitarized zone (DMZ). The DMZ is a separate network segment that hosts public-facing servers or services. The external firewall filters incoming traffic, while the internal firewall controls traffic between the internal network and the DMZ, providing an extra layer of protection.
3. Three-Legged Firewall: The three-legged firewall design consists of three network interfaces or network segments: the external network, the internal network, and a DMZ. The firewall acts as a gateway between these three segments, controlling traffic between them. This design provides a clear separation between external, internal, and DMZ networks, enhancing security by limiting direct communication between them.
4. Distributed Firewall: In a distributed firewall design, multiple firewalls are deployed at different locations within a network. Each firewall is responsible for protecting a specific network segment or department. This design provides localized protection and reduces the impact of a single point of failure. Centralized management and coordination among distributed firewalls are essential for consistent security policies.
5. Virtual Firewall: Virtual firewalls are designed to protect virtualized environments, such as cloud infrastructures or virtual private networks (VPNs). Virtual firewalls are software-based and operate within virtualized environments, providing security controls and traffic filtering between virtual machines or virtual networks.
6. Firewall Clustering: Firewall clustering involves combining multiple physical firewalls into a cluster to provide scalability, high availability, and load balancing. Clustering allows for distributing network traffic across multiple firewalls, ensuring uninterrupted service even if one firewall fails. Clustering can be implemented with active-active or active-passive configurations.
7. Transparent Firewall: A transparent firewall, also known as a bridging firewall, operates at the data-link layer (Layer 2) of the network stack. It intercepts and inspects network traffic without modifying the IP addresses or routing information. Transparent firewalls are often used to deploy security controls in existing network architectures without requiring significant changes to IP addressing or network configurations.

These are some of the common firewall design architectures used to protect networks and control network traffic flow. The choice of design depends on factors such as network size, complexity, security requirements, and budgetary considerations. It’s important to carefully plan and configure the firewall design to ensure effective protection and optimal network performance.

What is firewall design?

Firewall design includes an organization’s overall security policy decisions such as which firewall features to use, where to enforce the firewall, and, ultimately, how to configure the firewall.

How Does Firewall Design Work?

The five sequential steps to follow when designing a firewall include:

1. Identify security requirements for the organization. Evaluate security requirements, assess security posture and use the information in defining the security requirements.
2. Define an overall security policy. A well-defined security policy includes network resources, access policies and authorization controls and ensures that the firewall addresses all security requirements.
3. Define a firewall philosophy. Identifying resources, applications, and services to be protected against threats from outside the organization and insider attacks makes it easier to define and configure the firewall.
4. Identify permitted communications. Define an acceptable use policy to specify the types of network activities such as applications that are allowed and denied on the LAN and the Internet Web services.
5. Identify the firewall enforcement points. Determining enforcement points is fundamental to firewall design. Firewalls are deployed at the edge, between the private LAN and a public network, such as the Internet.

As measures of protection, develop a network traffic baseline profile that identifies network’s normal traffic patterns. Setting a baseline enables measuring irregular behavior and then setting thresholds to protect against attacks.

Problems Firewall Design Addresses

Firewall technology has evolved from packet filter firewalls to next-generation firewalls. New services and solutions have emerged to address the complexity of the cyber landscape, to protect resources, and to block attempts by cyber attackers to breach the firewall for nefarious purposes. Deploying an effective firewall for the network entails a great deal more than configuration. The best practices contribute to creating a security policy, enhancing the firewall design and configuration process, and deploying a firewall that meets the security requirements for the network.

What Can You Do with Firewall Design?

Best practices recommend that characterizing the network, documenting security posture, and determining the organization’s position in regard to security.

• Identify network resources and security requirements.
• Identify known threats and how to deal with attacks.
• Document operating systems, versions, and applications.
• Define organization’s workflow for allowed communications, access rights based on employee roles and user requirements.
• Determine the firewall enforcement points: deploy a firewall to protect the edge (Internet-facing), the core (corporate-facing), or the DMZ (bastion first line of defense)
• Design the firewall for simplicity.

As measures of protection, develop a network traffic baseline profile that identifies network’s normal traffic patterns. Setting a baseline enables measuring irregular behavior and then setting thresholds to protect against attacks.

Books on Firewall Designs