CISCO DISCOVERY PROTOCOL(CDP)

• Layer 2 or the Datalink layer provides physical addressing and access to media.

• It defines how data is to be formatted for transmission and how access to the network is
to be controlled.

• It also provides error detection, ensuring data on higher layers is formatted correctly for
transmission.

• Cisco Discovery Protocol (CDP) is a layer 2 protocol

• CDP is a Cisco proprietary protocol developed by Cisco Systems.

• It is used to discover other Cisco devices and can be used to share information such as
OS version IP address, etc.
 CISCO DISCOVERY PROTOCOL(CDP)

• CDP uses multicast frames for transmission and doesn't rely on higher layer protocols.

• It can also be used for On Demand Routing to include routing information in CDP
announcements so that dynamic routing protocols do not need to be used in simple
networks.
 LINK LAYER DISCOVERY PROTOCOL(LLDP)

• LLDP is a layer two discovery protocol and is similar to Cisco’s CDP.

• LLDP is a standard protocol that runs on all the devices by default while CDP is a Cisco
proprietary protocol that runs only on cisco devices.

• LLDP uses attributes that contain a type, length and value descriptions.

• These are called TLVs (Type, Length, Value).

• Devices that support LLDP use TLVs to send and receive information to their directly
connected neighbors.

• Port description TLV, System name TLV, System description TLV, System capabilities
TLV, Management Address TLV are some common types of TLV
 LINK LAYER DISCOVERY PROTOCOL(LLDP)

• LLDP is a layer two discovery protocol and is similar to Cisco’s CDP.

• LLDP is a standard protocol that runs on all the devices other than cisco devices by
default while CDP is a Cisco proprietary protocol that runs only on cisco devices.

• LLDP uses attributes that contain a type, length and value descriptions.

• These are called TLVs (Type, Length, Value).

• Devices that support LLDP use TLVs to send and receive information to their directly
connected neighbors.
 LINK LAYER DISCOVERY PROTOCOL(LLDP)

• To enable LLDP on a cisco device we have type the command : lldp run in configuration
mode.

• Some common types of TLV are :

• Port description TLV

• System name TLV
• System description TLV
• System capabilities TLV
• Management Address TLV
 TELNET & SSH

• There are two common protocols for remote management to your Cisco IOS router or
switch
• Telnet
• SSH.

• TELNET stands for Teletype Network.

• It is a client/server application protocol that provides access to virtual terminals of

remote systems on local area networks or the Internet.

• The local computer uses a telnet client program and the remote computers use a telnet
server program.
 TELNET & SSH

• TELNET is a type of protocol that enables one computer to connect to the local
computer.

• It is used as a standard TCP/IP protocol for virtual terminal service which is provided
by ISO.

• The computer which starts the connection is known as the local computer.

• The computer which is being connected to is known as the remote computer.

• During telnet operation, whatever is being performed on the remote computer will be
displayed by the local computer.

• Telnet operates on a client/server principle.

 TELNET & SSH

• The logging process can be further categorized into two parts:

• Local Login
• Remote Login

Local Login

• Whenever a user logs into its local system, it is known as local login.

• Keystrokes are accepted by the terminal driver when the user types at the terminal.

• Terminal Driver passes these characters to OS.

• Now, OS validates the combination of characters and opens the required application.
TELNET & SSH
 TELNET & SSH

2. Remote Login

• Remote Login is a process in which users can log in to a remote site i.e. computer and use
services that are available on the remote computer.

• With the help of remote login, a user is able to understand the result of transferring the
result of processing from the remote computer to the local computer.

• When the user types something on the local computer, the local operating system accepts
the character.

• The local computer does not interpret the characters, it will send them to the TELNET
client.
 TELNET & SSH

• TELNET client transforms these characters to a universal character set called Network Virtual
Terminal (NVT) characters and it will pass them to the local TCP/IP protocol Stack.

• Commands or text which are in the form of NVT, travel through the Internet and it will arrive at
the TCP/IP stack at the remote computer.

• Characters are then delivered to the operating system and later on passed to the TELNET server.

• Then TELNET server changes those characters to characters that can be understandable by a
remote computer.

• The remote operating system receives characters from a pseudo-terminal driver, which is a piece
of software that pretends that characters are coming from a terminal.

• The operating system then passes the character to the appropriate application program.
TELNET & SSH
TELNET & SSH (Network Virtual Terminal - NVT)
 TELNET & SSH (Network Virtual Terminal - NVT)

• NVT (Network Virtual Terminal) is a virtual terminal in TELNET that has a

fundamental structure that is shared by many different types of real terminals.

• NVT (Network Virtual Terminal) was created to make communication viable between
different types of terminals with different operating systems.
 TELNET & SSH

• Client-Server Interaction
• The Telnet client initiates the connection by sending requests to the Telnet server.
• Once the connection is established, the client can send commands to the server.
• The server processes these commands and responds accordingly.

• Character Flow

• When the user types on the local computer, the local operating system accepts the
characters.

• The Telnet client transforms these characters into a universal character set
called Network Virtual Terminal (NVT) characters.

• These NVT characters travel through the Internet to the remote computer via the local
TCP/IP protocol stack.
 TELNET & SSH

• The remote Telnet server converts these characters into a format understandable by
the remote computer.

• The remote operating system receives the characters from a pseudo-terminal driver
and passes them to the appropriate application program

• Network Virtual Terminal (NVT)

• NVT is a virtual terminal in Telnet that provides a common structure shared by

different types of real terminals.

• It ensures communication compatibility between various terminals with different

operating systems.
 TELNET & SSH

• The Secure Shell (SSH) protocol is a method for securely sending commands to a
computer over an unsecured network.

• SSH uses cryptography to authenticate and encrypt connections between devices.

• SSH also allows for tunneling, or port forwarding, which is when data packets are able to
cross networks that they would not otherwise be able to cross.

• SSH is often used for controlling servers remotely, for managing infrastructure, and for
transferring files.
TELNET & SSH
 TELNET & SSH

• SSH runs on top of TCP and has three protocol stacks as follows.

• SSH Transport Layer Protocol - This is mainly used for providing server authentication,
data integrity, confidentiality. Compression is provided optionally.

• SSH User Authentication Protocol - This protocol is used for authenticating users to the
server.

• SSH Connection Protocol - It multiplexes multiple logical communications channels

over a single SSH connection.
 TELNET & SSH

BASIC FEATURES OF SSH

• Encryption: Encrypted data is exchanged between the server and client, which ensures
confidentiality and prevents unauthorized attacks on the system.

• Authentication: For authentication, SSH uses public and private key pairs which provide
more security than traditional password authentication.

• Data Integrity: SSH provides Data Integrity of the message exchanged during the
communication.

• Tunneling: Through SSH we can create secure tunnels for forwarding network
connections over encrypted channels.
 TELNET & SSH

BASIC FEATURES OF SSH

• SSH encrypts all messages of communication between client and server.

• SSH provides confidentiality.

• SSH allows remote login

• SSH provides a secure File Transfer Protocol which help to transfer files over the Internet
securely.

• SSH supports tunneling which provides more secure connection communication.

 TELNET & SSH

• The port number of SSH is 22.

• It allow users to connect with server, without having to remember or enter password for
each system . It has 2 key pairs:

• Public key - Everyone can see it, no need to protect it. (for encryption function).
• Private key - Stays in computer, must be protected. (for decryption function).

• Key pairs can be of the following types:

• User Key - If the public key and private key remain with the user.
• Host Key - If public key and private key are on a remote system.
• Session key - Used when a large amount of data is to be transmitted.
 TELNET & SSH

• The SSH protocol adopts the following steps to communicate:

• The SSH protocol is run when a device initiates a connection request to the server

• The server will send a server key back as a reply to the client

• The client and server will negotiate the parameters and opens the secure channel

• The user then logins to the server host operating system.

 TELNET & SSH

• Symmetric Cryptography:

• In Symmetric key cryptography the same key used for encrypting and decrypting the
message

• Asymmetric Cryptography:

• In Asymmetric key cryptography the key used for encrypting is different from the key
used for decrypting the message.

• Hashing:

• Hashing is a procedure used in cryptography which convert variable length string to a

fixed length string, this fixed length value is called hash value which is generated by hash
function.
TELNET & SSH
 TELNET & SSH

Host Keys :

• Authentication occurs at Transport Layer, as the server uses different asymmetric

encryption techniques, the server has multiple host keys, it is compulsory that the server
must exchange its key to identify the host.

• For this process the client host must also know the server host key.

• The client has 2 methods of verifying the server host identity as follows.

• Client storing each hostname with name-to-key associations in his own local database,
This method requires to maintain huge data.

• If each host is certified by a Certificate Authority then the client can be able to verify
the host's identity by using certification Authority.
 SYSLOG

• Syslog is an industry standard protocol for message logging

• It is used to log events such as change in interface status (up to down) , change in routing
neighbor status, system restarts

• Syslog messages can be displayed in CLI

 SYSLOG

• All network devices such as routers, servers, firewalls, etc. create or prompt logs about
statuses and the events that occur.

• For a small system tracking these logs is not a problem, the problem arises when we are
dealing with big systems where tracking all these logs and information becomes
challenging.

• To overcome this problem we use Syslog with a logging server known as Syslog server

• Logs are essential when troubleshooting issues

 SYSLOG

• Syslog standard defines three layers :

• Syslog content layer -

It is the actual data contained in the event message. It contains some informational
elements such as the facility codes and severity levels.

• Syslog Application layer -

This layer generates, interprets, routes, and stores the message.

• Syslog Transport layer -

This layer transmits the message over a network.
 SYSLOG

• The normal syslog message contain the following values :

seq: time stamp : %facility-severity-Mnemonic:description

• seq - A sequence number indicating the sequence/order of a message.

• timestamp - A timestamp indicates at what time the message was generated.
• facility - A value that indicates which process on the device generated this message.
• severity - A number that indicates the severity of the logged event. There are 8 severity
levels.
• MNEMONIC - A shortcode for the message, indicating what happened.
• description - Detailed information about the event being reported.
 SYSLOG

• Syslog is usually used for troubleshooting.

• Syslog Severity levels are as follows:

 SYSLOG

• Syslog servers are used to collect Syslog messages from multiple sources into a single
location.

• A Syslog server can be a physical server or a virtual machine.

• Syslog listener -

• A Syslog listener allows the server to receive messages sent over the network by gathering
Syslog data sent over port 514 of UDP

• As UDP messages are not acknowledged some network devices might send Syslog data
through TCP also.
 SYSLOG

• Database -

• As large networks generate a lot of Syslog data they need to be able to store the Syslog data
for quick retrieval and easy reference.

• Automation and Filtering -

• It is hard to find specific log entries in a large amount of data.

• A Syslog server allows to collect as well as filter the logs.

 NTP

• Network Time Protocol (NTP) is a protocol that helps the computers clock times to be
synchronized in a network.

• This protocol is an application protocol that is responsible for the synchronization of

hosts on a TCP/IP network.

• This is required in a communication mechanism so that a seamless connection is present

between the computers.

• NTP servers have access to highly precise atomic clocks and GPU clocks

• It uses Coordinated Universal Time (UTC) to synchronize CPU clock time.

• Avoids even having a fraction of vulnerabilities in information exchange

communication.
 NTP

• Provides consistent timekeeping for file servers

• NTP is a time synchronisation protocol for network equipment which has a tree-like
architecture.

• Each level of the hierarchy is called a stratum.

• The standard has a limit of 16 stratums.

• Servers from the same stratum share a common time reference that they send to the
following stratrum

• Stratum 0 is made up of reference clocks which can be atomic clocks, GPS clocks, and
so on.
 NTP

• These are the root machines of the protocol that are responsible for providing the exact
time.

• Stratum 0 server will maintain a time known as UTC (Coordinated Universal Time ) time.

• Stratum 0 is connected to stratum 1 via serial ports.

• Stratum 1 is made up of primary NTP servers.

• These will broadcast the synchronisation timestamps to the rest of the network

• The protocol works in client/server mode between two machines belonging to different
stratums.
 NTP

• The client request for a timestamp to the server of the stratum above to which it has
access.

• The server will respond with enough information in order for the client to estimate the
transmission delay and the offset between its clock and that of the server.

• Then, the client will introduce a slight offset between its clock and that of the server.

• If the client itself acts as a server for the inferior stratum, this offset can be propagated
and amplified further down the network.

• As a result, even if the NTP protocol has a limit of 16 stratums, it is not recommended to
have servers which can be found at too great a distance from stratum 0 preferably
stratum 3 or 4
 NTP

• Cisco routers and switches can use three different NTP modes:

• NTP client mode.

• NTP server mode.
• NTP symmetric active mode.

• Client mode is a configuration where a device (the client) synchronizes its clock with a
designated NTP server.

• This means the client periodically sends requests to the server to obtain accurate time
information and adjust its own clock accordingly.

• It's a common configuration for network devices like routers, switches, and servers to
ensure accurate timestamps for logging and other time-sensitive operations
 Data Center Architecture

• Data Center is a dedicated space with strong security levels where enterprises or
organizations can store and share large amounts of data.

• Data centers are generally made up of racks (servers are stacked with each other),
cabinets, cables, and many more.

• Maintaining a data center requires a significant amount of networking knowledge

• There are basically two types of architecture that we employ for Data Centers :

• Three Layer Hierarchical Architecture

• Spine – Leaf Architecture
 Data Center Architecture

• Hosted website speed in data centers is usually based on the hardware and specifications
of an SSD-based server is faster and more expensive than an HDD-based server.

Old Data Center Design:

• It is mainly based on north-south traffic.

• To reach the server how much hope a packet will require wasn't predictable.

• It used to take a lot of time to reach a packet from server to server. We are not able to
handle east-west traffic.
Data Center Architecture
 Data Center Architecture

• It is also known as a spine-leaf design.

• It uses massive switches which are in the distribution layer.

• The distribution layer switches are known as spine nodes.

• The access layer switches are known as leaf nodes.

• It's now predictable how much hope a packet will take.

• Takes less time to reach a packet from server to server.

• Too many Fiber-optic cables. Handles north-south traffic as well as east-west traffic.
Data Center Architecture
 Data Center Architecture

• There are four primary types of data centers. Which are :

• Enterprise and Corporate Data Center

• Cloud Data Center
• Colocation Data Center
• Managed Data Center
 Data Center Architecture

Security:

• The main concern for data centers is security be it physical or virtual.

• Enterprises need to secure the data centers, so they make sure no unauthorized people
can enter the area.

• They should also build them where the effects of natural calamities are less

• Secure Firewalls, Packet Filtering and Inspection should also be done.

• Power Backup and AC should be provided on a 24/7 basis.

 SOFTWARE DEFINED NETWORK (SDN)

• Software Defined Networking (SDN) is an approach to network management that

enables dynamic, efficient and programmable network configuration

• It helps to improve network performance and monitoring.

• It is a new way of managing computer networks that makes them easier and more
flexible to control.

• In traditional networks the hardware (like routers and switches) decides how data
moves through the network

• In SDN the decision-making is done by a central software system.

 SOFTWARE DEFINED NETWORK (SDN)

• In traditional networks a device specifically performs multiple tasks

• All task performed by a device is maintained by three main planes of operation

• Control Plane
• Data Plane
• Management Plane

• The control plane of a network device is responsible for making decisions like
creating and maintaining routing tables, implementing network policies, and managing
routing protocols.
 SOFTWARE DEFINED NETWORK (SDN)

• The data plane is also known as the forwarding plane

• It is the part of a network device that handles the actual forwarding of data packets
based on instructions from the control plane.

• It is responsible for moving data traffic through the network, performing actions like
routing, switching, and applying security policies

• The management plane in a network device handles administrative tasks such as

configuration, monitoring, and troubleshooting.

• It provides the interface for network administrators to interact with the device and
manage its operations such as CLIs, web interfaces and other protocols used for
accessing and configuring the device.
SOFTWARE DEFINED NETWORK (SDN)
 SOFTWARE DEFINED NETWORK (SDN)

• In Software-Defined Networking (SDN), the control plane is removed from switches

and assigned to a centralized SDN controller.

• This allows network administrators to manage traffic from a single console instead of
configuring each switch individually.

• The data plane remains in the switch, forwarding packets based on flow tables set by
the controller.

• These tables contain match fields (like input port and packet header) and instructions
(forward, drop, or modify packets).

• If a packet doesn’t match any entry, the switch contacts the controller, which provides a
new flow entry to decide the packet’s path. A typical SDN architecture consists of three
layers.
 SOFTWARE DEFINED NETWORK (SDN)

• Application Layer: It contains the typical network applications like intrusion

detection, firewall, and load balancing

• Control Layer: It consists of the SDN controller which acts as the brain of the
network. It also allows hardware abstraction to the applications written on top of it.

• Infrastructure Layer: This consists of physical switches which form the data plane
and carries out the actual movement of data packets.
 SOFTWARE DEFINED NETWORK (SDN)

• Better Network Connectivity: SDN provides very better network connectivity for
sales, services, and internal communications. SDN also helps in faster data sharing.

• Better Deployment of Applications: Deployment of new applications, services, and

many business models can be speed up using Software Defined Networking.

• Better Security: Software-defined network provides better visibility throughout the

network. Operators can create separate zones for devices that require different levels of
security. SDN networks give more freedom to operators.

• Better Control With High Speed: Software-defined networking provides better speed
than other networking types by applying an open standard software-based controller.
 SOFTWARE DEFINED NETWORK (SDN)

• The SDN has 2 interfaces : South Bound Interface , North Bound Interface
 SOFTWARE DEFINED NETWORK (SDN)

• The SDN controller has to communicate with our network devices in order to program the data
plane.

• This is done through the southbound interface.

• This is not a physical interface but a software interface, often an API (Application Programming
Interface).

• An API is a software interface that allows an application to give access to other applications by
using pre-defined functions and data structures.

• Some popular southbound interfaces are: OpenFlow, Cisco OpFlex, CLI

 SOFTWARE DEFINED NETWORK (SDN)

• The northbound interface is used to access the SDN controller itself.

• This allows a network administrator to access the SDN to configure it or to retrieve

information from it.

• This could be done through a GUI but it also offers an API which allows other applications
access to the SDN controller.

• You can use this to write scripts and automate your network administration.
 SOFTWARE DEFINED NETWORK (SDN)

• REST API stands for REpresentational State Transfer API.

• It is a type of API (Application Programming Interface) that allows communication

between different systems over the internet.

• REST APIs work by sending requests and receiving responses, typically in JSON format,
between the client and server.

• REST APIs use HTTP methods (such as GET, POST, PUT, DELETE) to define actions
that can be performed on resources.

• These methods align with CRUD (Create, Read, Update, Delete) operations, which are
used to manipulate resources over the web
 SOFTWARE DEFINED NETWORK (SDN)

• A request is sent from the client to the server via a web URL, using one of the HTTP
methods.

• The server then responds with the requested resource, which could be HTML, XML,
Image, or JSON, with JSON being the most commonly used format for modern web
services.
 REST API FEATURES
• Representational

We transfer the representation of a resource between a server and a client. We use a data
format for this representation, typically JSON or XML.

• State Transfer

Each operation with a REST API is self-contained. Each request carries (transfers) all
information (state) to complete the operation.
 REST API FEATURES
• REST APIs use HTTP methods (such as GET, POST, PUT, DELETE) to define actions
that can be performed on resources.

• These methods align with CRUD (Create, Read, Update, Delete) operations, which are
used to manipulate resources over the web.

GET Method

• The HTTP GET method is used to read (or retrieve) a representation of a resource.

• HTTP response code of 200 (OK). In an error case, it most often returns a 404 (NOT
FOUND) or 400 (BAD REQUEST).
 REST API FEATURES
POST Method

• The POST method is commonly used to create new resources.

• It is often used to create subordinate resources related to a parent resource.

• Upon successful creation, the server returns HTTP status 201 (Created) along with a
Location header pointing to the newly created resource.

PUT Method

• PUT is an HTTP method used to update or create a resource on the server.

• When using PUT, the entire resource is sent in the request body, and it replaces the current
resource at the specified URL. If the resource doesn’t exist, it can create a new one.
 REST API FEATURES
PATCH Method

• PATCH is an HTTP method used to partially update a resource on the server.

• Unlike PUT, PATCH only requires the fields that need to be updated to be sent in the
request body.

• It modifies specific parts of the resource rather than replacing the entire resource

DELETE Method

• It is used to delete a resource identified by a URL.

• On successful deletion, return HTTP status 200 (OK) along with a response body.
 REST API FEATURES
• Stateless: Each request from a client to a server must contain all the information the server
needs to fulfill the request. No session state is stored on the server.

• Client-Server Architecture: RESTful APIs are based on a client-server model, where the
client and server operate independently, allowing scalability.

• Cacheable: Responses from the server can be explicitly marked as cacheable or non-
cacheable to improve performance.

• Uniform Interface: REST APIs follow a set of conventions and constraints, such as
consistent URL paths, standardized HTTP methods, and status codes, to ensure smooth
communication.

• Layered System: REST APIs can be deployed on multiple layers, which helps with
scalability and security.
 NETWORK MODELS IN DBMS
• The Network Model in a Database Management System (DBMS) is a data model that allows the
representation of many-to-many relationships in a more flexible and complex structure compared
to the Hierarchical Model

• The model is the generalization of the hierarchical model.

• This model can consist of multiple parent segments and these segments are grouped as levels but
there exists a logical association between the segments belonging to any level.

• This model is very simple and easy to design like the hierarchical data model.

• This model is capable of handling multiple types of relationships which can help in modeling real-
life applications, for example, 1: 1, 1: M, M: N relationships.

• In this model, we can access the data easily, and also there is a chance that the application can
access the owner's and the member's records within a set.
 NETWORK MODELS IN DBMS
• This network does not allow a member to exist without an owner which leads to the concept of
Data integrity.

• Like a hierarchical model, this model also does not have any database standard,

• This model allows to represent multi parent relationships.

 FIREWALLS

• A firewall is a network security device either hardware or software-based which monitors

all incoming and outgoing traffic

• Based on a defined set of security rules it accepts, rejects, or drops that specific traffic.

• Accept: allow the traffic

• Reject: block the traffic but reply with an “unreachable error”
• Drop: block the traffic with no reply

• A firewall is essentially the wall that separates a private internal network from the open
Internet at its very basic level.
 FIREWALLS

• Before Firewalls, network security was performed by Access Control Lists (ACLs)
residing on routers.

• ACLs cannot determine the nature of the packet it is blocking.

• ACL alone does not have the capacity to keep threats out of the network. Hence, the
Firewall was introduced.

• Firewalls can be classified into 8 types based on generations :

1) Packet firewall 5) Circuit Level Gateway

2) Statefull Inspection Firewall 6) Software Firewall
3) Application Layer Firewall 7) Hardware Firewall
4) Next Generation Firewall 8) Cloud Firewall
 FIREWALLS

• Firewall match the network traffic against the rule set defined in its table.

• Once the rule is matched, associate action is applied to the network traffic.

• Rules can be defined on the firewall based on the necessity and security policies of the
organization.

• On a server the network traffic can be either outgoing or incoming hence firewall
maintains a distinct set of rules for both the cases.

• The outgoing traffic originating from the server is allowed to pass through the firewalls.

• Still, setting a rule on outgoing traffic is always better in order to achieve more security
and prevent unwanted communication.
 FIREWALLS

• Incoming traffic is treated differently.

• Most traffic which reaches on the firewall is one of these three major protocols-
TCP, UDP or ICMP.

• All these types have a source address and destination address.

• TCP and UDP have port numbers. ICMP uses type code instead of port number which
identifies purpose of that packet.

• It is very difficult to explicitly cover every possible rule on the firewall.

• For this reason, the firewall must always have a default policy.
 FIREWALLS

• Default policy only consists of action (accept, reject or drop).

• Suppose no rule is defined about SSH connection to the server on the firewall it will
follow the default policy.

• If default policy on the firewall is set to accept, then any computer outside the network
can establish an SSH connection to the server.

• Therefore, setting default policy as drop (or reject) is always a good practice.
 FIREWALLS (PACKET FILTERING FIREWALLS)

• Packet filtering firewall is used to control network access by monitoring outgoing and
incoming packets and allowing them to pass or stop based on source and destination IP
address, protocols, and ports.

• It analyses traffic at the transport protocol layer (but mainly uses first 3 layers).

• Packet firewalls treat each packet in isolation.

• They have no ability to tell whether a packet is part of an existing stream of traffic.

• It allows or deny the packets based on unique packet headers.

• Packet filtering firewall maintains a filtering table that decides whether the packet will
be forwarded or discarded.
 FIREWALLS (PACKET FILTERING FIREWALLS)
• AN EXAMPLE OF A FILTERING TABLE :

SOURCE IP DEST IP SOURCE PORT DEST PORT ACTION

[Link] ----------------- ------------------------ ----------------- DENY
---------------- [Link] ------------------------ ----------------- DENY
---------------- ----------------- ------------------------ 23 DENY
---------------- [Link] ------------------------ >1023 ALLOW

• Incoming packets from network [Link] are blocked.

• Incoming packets destined for host [Link] are blocked.
• Incoming packets destined for the internal TELNET server (port 23) are blocked.
• All well-known services to the network [Link] are allowed.
 FIREWALLS (STATEFUL INSPECTION FIREWALLS)

• Stateful firewalls (performs Stateful Packet Inspection) are able to determine the
connection state of packet which makes it more efficient.

• It keeps track of the state of networks connection travelling across it like TCP streams.

• The filtering decisions would not only be based on defined rules but also on packet’s
history in the state table.

• Connection states represent the current status of a communication link between two
systems, indicating whether the connection is established, in the process of being
established or terminated, or if it's inactive.

• These states are crucial for understanding how data flows and how connections are
managed in networking and various applications
 FIREWALLS (STATEFUL INSPECTION FIREWALLS)

State Tracking:

Stateful firewalls maintain a record of active connections, including source and destination
IP addresses, ports, and protocol information.

Contextual Analysis:

By tracking connection states, these firewalls can analyze traffic patterns and identify
potentially malicious or anomalous behavior.

Dynamic Control:

Stateful firewalls can dynamically adjust security rules based on ongoing connection states,
allowing or denying traffic based on pre-established policies and the context of the
connection
 FIREWALLS (STATEFUL INSPECTION FIREWALLS)

Packet Inspection:

They inspect the contents of data packets, not just the headers, to identify and filter out
malicious data

Protection against various threats:

Stateful firewalls can protect against network security threats like viruses, worms, and
spyware, as well as attacks targeting specific IP addresses and geographic region
 FIREWALLS (APPLICATION LAYER FIREWALLS)

• Application layer firewall can inspect and filter the packets on any OSI layer up to the
application layer.

• It has the ability to block specific content, also recognize when certain application and
protocols (like HTTP, FTP) are being misused.

• Application layer firewalls are hosts that run proxy servers.

• A proxy firewall prevents the direct connection between either side of the firewall each
packet has to pass through the proxy.
 FIREWALLS (NEXT GENERATION FIREWALLS)

• NGFW consists of Deep Packet Inspection, Application Inspection, SSL/SSH inspection

and many functionalities to protect the network from these modern threats.

• It is a network security device that offers advanced features like application control,
intrusion prevention, and threat intelligence

Application Awareness and Control:

NGFWs can identify and control traffic based on the application being used, not just the port
or protocol

Intrusion Prevention System (IPS):

Built-in IPS capabilities can detect and prevent a wide range of malicious activity
 FIREWALLS (NEXT GENERATION FIREWALLS)

• NGFW consists of Deep Packet Inspection, Application Inspection, SSL/SSH inspection

and many functionalities to protect the network from these modern threats.

• It is a network security device that offers advanced features like application control,
intrusion prevention, and threat intelligence

Application Awareness and Control:

NGFWs can identify and control traffic based on the application being used, not just the port
or protocol

Intrusion Prevention System (IPS):

Built-in IPS capabilities can detect and prevent a wide range of malicious activity