BY – Dashrath Jamadar

Firewall – Complete Guide for SOC Analysts

A Firewall is a critical security device or software that monitors and controls incoming and outgoing
network traffic based on predefined security rules. It acts as a barrier between trusted internal networks
and untrusted external networks, such as the internet that inspects, filters, and controls traffic to protect
internal resources from unauthorized access, malware, and cyber threats.

Purpose: Prevent unauthorized access, enforce security policies, and protect sensitive data.
Works at: Network Layer (OSI Layer 3), Transport Layer (Layer 4), and Application Layer (Layer 7).

Types of Firewalls:
1. Packet Filtering Firewall

• How it works: Inspects each packet’s headers (source & destination IP, port, protocol) and allows
or blocks traffic based on rules.

• Key Feature: Works at the Network Layer (Layer 3) and Transport Layer (Layer 4) of the OSI
model.

• Example: Access Control Lists (ACLs) in routers.

• Use Case: Basic network security, blocking or allowing specific traffic.

• Limitation: Cannot inspect packet contents (payload).

2. Stateful Inspection Firewall (Dynamic Packet Filtering Firewall)

• How it works: Monitors active connections and makes decisions based on state, context, and
rules.

• Key Feature: Keeps track of session states and works at Layers 3, 4, and 5 (Network, Transport,
and Session Layers).
BY – Dashrath Jamadar

• Example: Cisco ASA, Check Point Firewalls.

• Use Case: More secure than packet filtering; used in corporate networks.

• Limitation: Can slow down performance due to session tracking.

3. Proxy Firewall (Application Layer Firewall)

• How it works: Acts as an intermediary between users and the internet, inspecting application-
layer (Layer 7) traffic.

• Key Feature: Deep Packet Inspection (DPI) to analyze full packet contents.

• Example: Squid Proxy, Blue Coat Proxy.

• Use Case: Used for content filtering, blocking malicious sites, and enforcing web usage policies.

• Limitation: Slower due to content analysis.

4. Next-Generation Firewall (NGFW)

• How it works: Combines traditional firewall features with advanced security functions like
Intrusion Prevention System (IPS), Deep Packet Inspection (DPI), and Threat Intelligence.

• Key Feature: Works at all OSI layers (Layer 2 - Layer 7).

• Example: Palo Alto Networks, Fortinet, Cisco Firepower.

• Use Case: Enterprise-level security for detecting and preventing modern threats.

• Limitation: Expensive and resource-intensive.

5. Web Application Firewall (WAF)

• How it works: Protects web applications by filtering and monitoring HTTP/HTTPS traffic.

• Key Feature: Detects and prevents web attacks like SQL Injection, Cross-Site Scripting (XSS), and
CSRF.

• Example: AWS WAF, Cloudflare WAF, Imperva WAF.

• Use Case: Protects web applications from application-layer attacks.

• Limitation: Does not protect non-web services.

6. Circuit-Level Gateway Firewall

• How it works: Verifies TCP handshakes without inspecting packet contents.

• Key Feature: Works at the Session Layer (Layer 5) of the OSI model.

• Example: SOCKS Proxy.

• Use Case: Used for hiding internal network structures.

• Limitation: Does not inspect the actual data payload, only connection state.
BY – Dashrath Jamadar

7. Cloud-Based Firewall (Firewall as a Service - FWaaS)

• How it works: Hosted in the cloud and provides firewall capabilities without on-premise
hardware.

• Key Feature: Scalable, managed firewall solution.

• Example: Zscaler, Palo Alto Prisma, Cloudflare Magic Firewall.

• Use Case: Protects cloud environments, SaaS applications, and remote users.

• Limitation: Dependent on internet connectivity.

8. Host-Based Firewall

• How it works: Installed on individual devices to filter incoming and outgoing traffic.

• Key Feature: Protects individual hosts rather than an entire network.

• Example: Windows Defender Firewall, iptables (Linux).

• Use Case: Endpoint security, blocking unauthorized connections to/from a system.

• Limitation: Cannot protect the entire network.

Comparison of Firewall Types

Firewall Type OSI Layer Pros Cons

Packet Filtering Layer 3, 4 Fast, simple Cannot inspect payload
Layer 3, 4,
Stateful Inspection Tracks sessions Performance impact
5
Proxy Firewall Layer 7 Deep packet inspection Slower performance
Next-Generation (NGFW) Layer 3 - 7 Advanced threat protection Expensive
Web Application Firewall (WAF) Layer 7 Protects web apps Not for non-web traffic
Circuit-Level Gateway Layer 5 Hides internal network No content inspection
Cloud-Based Firewall Cloud Scalable, no hardware Internet-dependent
Host-Based Firewall Endpoint Protects individual devices No network-wide security

2. How a Firewall Works

A firewall inspects network traffic using rules, policies, and signatures to allow or block traffic.

Packet Filtering – Analyzes IP headers and determines if a packet is allowed.

Stateful Inspection – Tracks active connections and permits legitimate responses.
Deep Packet Inspection (DPI) – Inspects entire packet contents for threats.
Application-Layer Filtering – Blocks unauthorized applications like P2P sharing.

Example Flow of Firewall Traffic:

1. User sends a request → HTTP request to [Link].

BY – Dashrath Jamadar

2. Firewall inspects the packet → Checks source, destination, and security policies.

3. Decision made → Traffic is allowed or blocked based on rules.

4. Logging & Alerting → Suspicious traffic is logged and sent to SIEM.

3. Log Formats Supported by Firewalls

Firewalls generate logs in formats like:

• Syslog – Standard logging format for integration with SIEM.

• Common Event Format (CEF) – Used in security tools like ArcSight.

• Log Event Extended Format (LEEF) – IBM QRadar-compatible logs.

• JSON & CSV – Used for structured logging and API-based log ingestion.

4. Logs Generated and Sent to SIEM

Common Firewall Logs Sent to SIEM:

1. Traffic Logs – Logs allowed and blocked network traffic.

2. Connection Logs – Source/destination IPs, ports, and protocols.

3. Intrusion Prevention Logs – Logs suspicious or attack-related packets.

4. Blocked IPs & Blacklist Logs – Tracks denied connections.

5. Policy Violation Logs – Detects unauthorized protocol usage.

6. Malware & Threat Detection Logs – Logs flagged malicious traffic.

7. Authentication Logs – VPN and remote access firewall authentication attempts.

Example Firewall Log Entry (Syslog Format):

Feb 16 10:30:00 Firewall-01 BLOCK src_ip=[Link] dst_ip=[Link] port=443 protocol=TCP

action=Denied rule=Block_Untrusted

5. Advantages of Firewalls

Protects Internal Networks – Blocks unauthorized traffic from reaching internal systems.
Prevents Cyber Attacks – Filters out threats like malware, DDoS attacks, and unauthorized access.
Monitors & Logs Network Activity – Helps SOC teams analyze security incidents.
Enforces Security Policies – Controls what traffic is allowed or blocked.
Reduces Attack Surface – Blocks unnecessary services, ports, and IPs.
BY – Dashrath Jamadar

6. Disadvantages of Firewalls

Not a Complete Security Solution – Cannot stop attacks like phishing or insider threats.
Performance Impact – Stateful inspection and DPI can slow down traffic.
Misconfiguration Risks – Weak firewall rules can leave networks vulnerable.
Cannot Detect Encrypted Threats – Limited visibility into SSL/TLS traffic without decryption.

7. Firewall Log Flow to SIEM

1. User sends a request → Firewall logs connection attempt.

2. Firewall applies rules → Allows or blocks the connection.

3. Log generated → Firewall logs are sent to SIEM.

4. SIEM Correlation → SIEM detects anomalies based on firewall logs.

5. SOC Investigation → Analysts review alerts and respond to threats.

Example SIEM Use Case:

• Scenario: A user is accessing a restricted website.

• Firewall Action:

o Logs the access attempt.

o Blocks the request if policy violation detected.

o Sends logs to SIEM for monitoring.

o SOC team investigates and takes action.

8. Top Firewall Vendors in 2025

1. Palo Alto Networks Next-Generation Firewall (NGFW)

2. Fortinet FortiGate Firewall

3. Cisco Firepower

4. Check Point Security Gateway

5. Juniper SRX Firewall

6. Sophos XG Firewall

7. SonicWall Next-Gen Firewall

BY – Dashrath Jamadar

8. WatchGuard Firebox

9. Barracuda CloudGen Firewall

10. AWS Network Firewall

9. 20 Firewall Use Cases for SOC Analysts

Traffic Filtering & Access Control

1. Blocking Unauthorized IPs – Prevents known malicious IPs from accessing the network.

2. Restricting High-Risk Ports – Blocks unnecessary services (e.g., Telnet, SMB).

3. Allowing Only Approved Applications – Ensures only authorized applications run.

4. Geo-Blocking High-Risk Countries – Prevents access from specific regions.

5. Limiting VPN Access by Location – Restricts remote access based on country.

Threat Detection & Prevention

6. Detecting Large Data Transfers – Identifies potential data exfiltration.

7. Blocking Tor & Proxy Traffic – Prevents anonymized browsing to bypass controls.

8. Detecting Command & Control (C2) Communications – Identifies infected systems.

9. Preventing Lateral Movement – Blocks unauthorized internal network traversal.

10. Monitoring Failed Access Attempts – Detects brute-force or credential stuffing attacks.

Intrusion Prevention & Malware Protection

11. Blocking Exploit Attempts – Prevents known vulnerabilities from being exploited.

12. Detecting DDoS Attacks – Identifies and mitigates volumetric attacks.

13. Filtering Out Malicious Domains – Blocks phishing and malware-hosting websites.

14. Detecting Encrypted Malware Traffic – Identifies suspicious SSL/TLS connections.

15. Sandboxing Suspicious Files – Integrates with NGFWs to analyze unknown files.

Compliance & Policy Enforcement

16. Logging All Admin Firewall Changes – Tracks unauthorized modifications.

17. Detecting Unauthorized IoT Devices – Prevents rogue devices from connecting.

18. Ensuring PCI DSS Compliance – Monitors and controls credit card data flow.

19. Blocking P2P & Unauthorized File Sharing – Prevents copyright violations.

20. Enforcing Zero Trust Network Segmentation – Restricts access to critical assets.