Comparison and analysis of firewall Routing and professional Firewall application

The simplicity and complexity of the user's network topology and the ease of user application are not the criteria for deciding whether or not to use a firewall, but a fundamental condition to determine whether a user is using a firewall is the user's need for network security!

The background of the emergence and existence of two kinds of equipment is different

1, the two kinds of equipment produced by different sources

The generation of routers is based on the routing of Network packets. Routers need to do is to the different network packets for efficient routing, as to why the route, whether it should be routed, whether there is a problem after the route does not care, is concerned: whether the different network segments of the packet routing to communicate.

Firewalls are the result of people's need for security. Whether the packet can be the correct arrival, arrival time, direction, etc. is not the focus of the firewall, the focus is whether this (a series of) packets should be passed, through the network will cause harm.

2, the fundamental purpose is different

The fundamental purpose of routers is to keep the network and data "through".

The fundamental purpose of a firewall is to ensure that any packets that are not allowed are "not".

Ii. Differences in Core technology

Cisco router core ACL list is based on simple packet filtering, from the perspective of firewall technology implementation, Neteye Firewall is based on State packet filtering application-level information flow filtering.

One of the simplest applications: a mainframe in the intranet that provides services through routers (assuming the port that provides the service is TCP 1455). In order to ensure security, the router needs to be configured on the "outside-" to allow only client access to the server's TCP 1455 port, and other rejections.

For today's configuration, the security vulnerabilities are as follows:

1, IP address spoofing (so that the connection is not normal reset)

2. TCP Spoofing (Session replay and hijacking)

The reason for these pitfalls is that routers cannot monitor TCP status. If the Neteye firewall is placed between the client and the router in the intranet, the vulnerability can be completely eliminated because the Neteye firewall can detect TCP status and can randomly generate the TCP serial number. At the same time, the Neteye Firewall's one-time password Authentication client function, can realize in the application completely transparent situation, realizes to the user the access control, its authentication supports the standard RADIUS protocol and the local authentication database, may carry on the interoperability with the third party authentication server completely, and can realize the role division.