Experts teach you how to identify the actual functional differences between firewalls

Some problems often confuse users: in the function of products, the description of each manufacturer is very similar, some "up-and-comer" and well-known brands are very much alike. In the face of this situation, how to identify?

Products described very similar, even the same functionality, in the implementation of the specific, usability and ease of use, the individual difference is very obvious.

First, the network layer of access control

All firewalls must have this feature, otherwise they cannot be called firewalls. Of course, most routers can also implement this function through their own ACLs.

1. Rule editing

The access control of the network layer is mainly reflected in the rules of the firewall editing, we must investigate: the network layer of access control can be expressed through the rules? Is the granularity of access control thin enough? Does the same rule provide control at different time periods? Does the rule configuration provide a friendly interface? Can it easily embody the security will of network management?

2, Ip/mac address binding

The same is Ip/mac address binding function, some details must be inspected, such as firewall can achieve IP address and MAC address automatic collection? Do you provide an appropriate alert mechanism for access violations of the IP/MAC address binding rules? Because these functions are very practical, if the firewall can not provide IP address and automatic collection of MAC addresses, network management may be forced to take other means to obtain the IP and MAC address of the user under the jurisdiction, it will be a very tedious job.

3, NAT (network address translation)

This function of the original router has evolved into one of the standard functions of the firewall. But to this one function, each factory realizes the difference is very big, many manufacturers realize the NAT function to have the very big problem: difficult to configure and use, this will cause the network administrator to bring the huge trouble. We must learn the principle of NAT, improve the level of network knowledge, through analysis and comparison, to find a NAT configuration and use of simple to deal with the firewall.

Access control of Application layer

This function is the strength of each firewall manufacturer competition point, is also the most brilliant place. Because a lot of firewall based on free operating system can have State monitoring module (because Linux, FreeBSD and other kernel modules already support state monitoring), but the control of the application layer cannot realize "copycat", need real programming.