\section{Firewalls}
\begin{frame}
   {What is a Firewall?}

   \begin{itemize}
      \item
      Essential security facility in modern networks
      \item
      Control incoming and outgoing access to systems and
      network
      \item
      Protect against intrusions and other attack vectors
      \item
      Control trust level on particular interfaces and/or
      addresses
      \item
      \textbf{Rules} control flexible barriers depending on
      trust levels and network topography
   \end{itemize}

\end{frame}

\cprotect\note{

   A \textbf{firewall} is a network security system that
   monitors and controls all network traffic.  It applies
   \textbf{rules} on both incoming and outgoing network
   connections and packets and builds flexible barriers
   (i.e., firewalls) depending on the level of trust of a
   given connection.

   Firewalls can be hardware or software based.  They are
   found both in network routers as well as in individual
   computers, or network nodes.  Many firewalls also have
   routing capabilities.

}

\begin{frame}
   {Packet Filtering}

   \begin{itemize}
      \item
      Basis for building firewalls
      \item
      Each packet in a network stream is examined
      \item
      System-defined \textbf{rules} are followed
      \item
      Actions can include, accept, drop, mangle, redirect, etc.
   \end{itemize}

\end{frame}

\cprotect\note{

   Almost all firewalls are based on \textbf{Packet
      Filtering}

   Information is transmitted across networks in the form of
   packets, each one of which has:
   \begin{itemize}
      \item Header
      \item Payload
      \item Footer
   \end{itemize}

   The header and footer contain information about
   destination and source addresses, what kind of packet it
   is and which protocol it obeys, various flags, and which
   packet number this is in a stream, and all sorts of other
   metadata about transmissions

   The actual data is in the payload.

   Packet filtering intercepts packets at one or more stages
   in network transmission, including application, transport,
   network and datalink.

   A firewall establishes a set of \textbf{rules} by which
   each packet may be :
   \begin{itemize}
      \item Accepted or Rejected based on content, address etc.
      \item Mangled in some way
      \item Redirected to another address
      \item Inspected for security reasons
      \item etc.
   \end{itemize}

   Various utilities exist for establishing rules and actions
   to be taken as the result of packet filtering.

}


\begin{frame}
   {Firewall Generations}

   \begin{itemize}
      \item
      \textbf{Packet Filtering}: Inspect each packet and drop,
      reject or send on
      \item
      \textbf{Stateful Filters}: Examine \textbf{connection
         state} and consider if part of a new connection or an
      existing one, or none
      \item
      \textbf{Application Layer Firewalls}: Aware of
      application and protocol packet is associated with
   \end{itemize}

\end{frame}

\cprotect\note {

   Early firewalls (dating back to the late 1980's) were
   based on \textbf{packet filtering}; the content of each
   network packet was inspected and was either dropped,
   rejected, or sent on.  No consideration was given about
   the \textbf{connection state}; what stream of traffic
   the packet was part of.

   The next generation of firewalls were based on
   \textbf{stateful filters} which also examine the
   \textbf{connection state} of the packet; is it a new
   connection, part of an already existing one, or part of
   none.  Denial of service attacks can bombard this kind
   of firewall to try and overwhelm it.

   The third generation of firewalls is called
   \textbf{Application Layer Firewalls}, and are aware of
   the kind of application and protocol the connection is
   using.  They can block anything which should not be part
   of the normal flow.

}


