How to identify differences in hardware firewall performance

Some problems often confuse users: in the function of products, the description of each manufacturer is very similar, some "up-and-comer" and well-known brands are very much alike. In the face of this situation, how to identify? products that are described very similar, even the same function, in the specific implementation, usability and ease of use, the individual differences are also obvious.

First, the network layer of access control

All firewalls must have this feature, otherwise they cannot be called firewalls. Of course, most routers can also implement this function through their own ACLs.

1. Rule editing

The access control of the network layer is mainly reflected in the rules of the firewall editing, we must investigate: the network layer of access control can be expressed through the rules? is the granularity of access control thin enough? Does the same rule provide control at different time periods? Does the rule configuration provide a friendly interface? Can it easily embody the security will of network management?

2.ip/mac Address Binding

The same is Ip/mac address binding function, there are some details must be examined, such as firewall can achieve IP address and MAC address automatic collection? Is it possible to provide an alarm mechanism for violations of IP/MAC address binding rules? Because these features are very practical, If the firewall can not provide automatic collection of IP address and MAC address, network management may be forced to take other means to obtain the IP and MAC address of the user under jurisdiction, this will be a very tedious job.

3, NAT (network address translation)

This function of the original router has evolved into one of the standard functions of the firewall. But to this one function, each factory realizes the difference is very big, many manufacturers realize the NAT function to have the very big problem: difficult to configure and use, this will cause the network administrator to bring the huge trouble. We must learn the principle of NAT, improve the level of network knowledge, through analysis and comparison, to find a NAT configuration and use of simple to deal with the firewall.

Access control of Application layer

This function is the strength of each firewall manufacturer competition point, is also the most brilliant place. Because a lot of firewall based on free operating system can have State monitoring module (because Linux, FreeBSD and other kernel modules already support state monitoring), but the control of the application layer cannot realize "copycat", need real programming.

On the control of the application layer, the following points can be examined when choosing a firewall.

1. Do you provide content filtering for HTTP protocol?

In the current enterprise network environment, the two main applications are WWW access and email. The fine granularity of control over WWW access reflects the technical strength of a firewall.

2. Do you provide content filtering for the SMTP protocol?

More and more attacks on e-mail messages: Mail bombs, mail viruses, leaking confidential information, etc., can provide content filtering based on SMTP protocol and filtering granularity has become the focus of attention of users.

3. Do you provide content filtering for FTP protocols?

In the review of this function must be careful, many manufacturers of firewalls are advertised with FTP content filtering, but careful contrast will find that most of them only implemented the FTP protocol in the control of two commands: Put and get. A good firewall should be able to control all other FTP commands, including CDs, LS, and so on, to provide command-level control, to achieve access control of directories and files, all filters support wildcard characters.