Vro technology for building firewalls

China's router technology is very mature and stable, and it can also ensure the network security of users. Here we will introduce how to configure NAT, including the application IDS features and other options. Nowadays, network security has become the primary concern of every online enterprise, and firewalls have been adopted as a main security mechanism. Although some enterprises have begun to work on "firewall Applications", I am not saying that this is the best solution), these applications are very expensive for small and medium enterprises. For example, a Cisco PIX Firewall costs thousands of US dollars. However, there is now a cheap and cost-effective firewall solution, which may have been ignored by everyone. Currently, many companies use standard router technology to connect to the Internet. If you are using a Cisco router, you should know that Cisco IOS integrates a series of functions to build firewall and intrusion detection systems. With these features, you can no longer need a separate firewall device firewall box), you can use the existing router technology to build your own firewall. I like to call this solution a "poor firewall ".

Configure NAT

Next, you must configure the firewall and IDS correctly. As I mentioned above, you can configure the most basic firewall by extending the IP address access control list. This is also the benchmark for configuring more advanced firewalls. Because many companies use Network Address Translation (NAT) and private TCP/IP addresses within the enterprise, we should first configure this part of the access control list. Generally, NAT is implemented in the following environment: vro technology connects to the Internet through a serial port and a LAN through an Ethernet port. In this case, NAT enhances the confidentiality and security of the internal network by using private TCP/IP addresses in the enterprise intranet. In addition, after an enterprise changes the Internet service provider's ISP, it does not have to change the internal network address.

Note that the IP address of the Local Web server is 10.253.1.1 and that of the local email server is 10.253.1.2. Before implementing the firewall, the two systems with public IP addresses, 1.1.1.1 Web servers) and 1.1.1.2 email servers are not protected on the Internet. Now, the two servers have internal IP addresses, and their external public IP addresses are converted into internal IP addresses at the firewall. Similarly, other internal and external addresses are converted accordingly. packets whose destination address is not a local 10. x network will be sent through the serial port. For network security, it is very important to record all types of data blocked by the firewall into logs. Although each access control list clearly lists the packets that should be rejected, the firewall cannot record these packets into logs. We recommend that you install a log server on the network so that the router technology can log on to the log server and record all data packets rejected by the firewall. In this example, the Web server in the network is also a log server.

Application IDS features and other options

Intrusion Detection System (IDS) is another important area of network security. Cisco IDS can recognize "Attack Characteristics", which is called "attack mode ". Taking spam as an example, Cisco IDS can identify the source of spam and take specified measures to handle it. Or discard the warranty, or notify the Administrator .) In the future, I may write an article about how to configure Cisco IDS. Because IDS is only an optional part of the firewall, I still have the opportunity to introduce it again. However, we recommend that you carefully read the configuration of the Cisco IOS intrusion detection system before configuring Cisco IDS. Two important features of Cisco FW/IDS are context-based access control (CBAC) and TCP Intercept interception ). CBAC can identify the "context" environment of data packets and create a dynamic access control list based on the context.

Take FTP communication as an example. If you only allow external FTP access, you should use CBAC instead of opening the corresponding port in the access control list. In general, the firewall should reject FTP data response packets from accessing the Intranet. However, CBAC can identify that the FTP connection is initiated from the internal network and automatically open the corresponding port, in this way, the data Response Message is returned to the Intranet user. When this communication does not occur, your network will not have a "breakthrough" open port), hackers will not be able to attack, so this will make your network more secure. TCP packet interception can prevent your network from DoS attacks ). Before a packet arrives at the server in the target host network, TCP packet capture can check whether the source address of a TCP packet exists. If the source address does not exist, the router technology can discard the TCP packet before it reaches the server, and consume its effective processing time, which can stop the DoS attack process.

Summary

We can see that Cisco ios fw/IDS provides powerful functions. It can implement router technology and firewall on a device. for my company, this is a cost-effective solution. For your company, this may also be a cost-effective solution. Although this article only introduces some superficial knowledge about building a Cisco IOS Firewall, it may be a good start for you. The following are some URLs for building the Cisco IOS Firewall.