Next-Generation Firewall (NGFW) Concepts

NGFW (Next-Generation Firewall)

• NGFW is a combination of a traditional firewall (FW) and an Intrusion Prevention System (IPS)
• NGFW must include:
  • Standard firewall capabilities like stateful inspection
  • Integrated intrusion prevention
  • Application awareness and control to see and block risky apps
  • Threat intelligent sources
  • Upgrade paths to include future information feeds
  • Techniques to address evolving security threats

Common NGFW Examples

• Firepower 1000 series
• Firepower 2100 series
• Firepower 4100 series
• Firepower 9300 series

Server and Client

• A server is a computer or system that provides resources, data, services, or programs to other computers (clients) over a network (LAN/WAN)
• A client can be a computer, phone, or any device that consumes or generates new data
• A device can be both a server and a client at the same time

Endpoints

• Endpoints are clients that consume or generate new data
• Examples of endpoints include IP phones, web, mobile, and desktop clients
• Endpoints can also refer to end hosts or host devices such as desktops, laptops, mobile phones, and servers

Network Operating System (NOS)

• A NOS is a computer operating system that facilitates connection and communication between autonomous computers over a network
• Examples of NOS include Microsoft Windows Server 2003, Microsoft Windows Server 2008, UNIX, Linux, Mac OS X, Novell NetWare, and BSD

Protocols

• A protocol is a set of rules that governs communication between computers on a network
• Many different types of network protocols and standards are required to ensure communication between computers
• Examples of protocols include:
  • File Transfer Protocol (FTP) - port 20, 21
  • Secured Shell (SSH) - port 22
  • Telnet - port 23
  • Simple Mail Transfer Protocol (SMTP) - port 25
  • Domain Name System (DNS) - port 53
  • Dynamic host configuration protocol (DHCP) - port 67, 68
  • Trivial file transfer protocol (TFTP) - port 69
  • Hypertext Transfer Protocol (HTTP) - port 80
  • Kerberos - port 88
  • Post Office Protocol version 3 (POP 3) - port 110
  • Network time protocol (NTP) - port 123
  • Simple Network Management Protocol (SNMP) - port 161
  • Border gateway protocol (BGP) - port 179
  • Lightweight directory access protocol (LDAP) - port 389
  • Hypertext Transfer Protocol over SSL/TLS (HTTPS) - port 443
  • Syslog - port 514

Shell and Kernel

• A shell is an interface between the kernel and the user
• A kernel is the core of an operating system, controlling all tasks that come with a system

Network

• A network is a collection of devices connected together to facilitate communication and resource sharing
• Networks can be small (two computers directly connected) or large (the Internet with millions of devices)
• Networks are used for:
  • Information sharing
  • File sharing
  • Resource sharing
  • Application sharing

Computer Network Components

• Hardware components:
  • Computer
  • Network Interface Card (NIC)
  • Media/cables
  • Switch/hub
  • Router
  • Modem
  • Firewall
• Software components:
  • Network Operating System (NOS)
  • Protocol
  • Firewall

NIC (Network Interface Card)

• A NIC is a computer expansion card for connecting to a network using an Ethernet cable with an RJ-45 connector

Hub

• A hub is a physical layer networking device that connects multiple devices in a network