Network
Security
Packet Filtering via Access Control Lists
(ACLs)
As you probably already know, all information that flows across the Internet
uses TCP/IP and, in turn, this information is sent in small pieces known as
packets. In the early days of the Internet, filtering based on packets was
common and, in many cases, routers in many networks still use packet
filtering. Packet filters are often used as a first defense in combination with
other firewall technologies. Today, their most common implementation is
seen in the access control lists of routers at the perimeters of networks.
Packet Filtering
Packet filtering is one of the oldest and most common types of packet
inspection technologies available. It begins by inspecting a packet’s contents
and applying rules to determine whether a packet should be dropped or
allowed.
Packet Filtering
The method used to configure and deploy packet filters on Cisco routers is
known as access control lists (ACLs).The two main types of ACLs are standard
ACLs, which filter based on IP address, and extended ACLs, which look further
into a packet header, if so configured. Standard ACLs are source address-
based and extended ACLs are source-based and destination-based and have
more capabilities, such as specifying port or protocol.
Packet Filtering
The following ACL styles for IP are supported:
• Standard IP ACLs—Use source addresses for matching operations
• Extended IP ACLs (control plane only)—Usesource and destination
addresses for matching operations, and optional protocol type and port
numbers for finer granularity of control
• Named ACLs—Use source addresses for matching operations
Packet Filtering
Packet filters inspect each packet of data individually, examining source and
destination IP address and ports. Only the most basic attributes of each
packet are examined; for this reason, they can decide packet flow quickly. The
characteristics of each one of these inspection points determine whether the
given packet should be allowed or denied.
Packet Filtering
Because every packet of every connection is checked against the access
control rules, larger, complex packet-filtering rule bases could decrease
performance of the device upon which they are applied. In addition, because
packet filters can check only low-level attributes, they are not secure against
malicious code hiding in the other layers.
Packet Filtering
Packet Filtering
Packet Filtering
You are probably wondering what happened to the deny statements? With
Cisco ACLs, there is that implicit deny everything else at the end, which you
do not “see” in the configuration. Thus, you do not have to enter the deny
statements.
Because they are designed to identify packets, ACLs fulfill many roles in the
world of networking. After a packet is identified, it can be acted upon in some
manner. This action might include sending it after a more important packet, or
perhaps filtering the packet.
Placement of packet filters
Limitations of Packet Filtering
It is time to talk about the drawbacks of using packet filtering. Certainly, you
can stop many things with their use. Consider that you have a web server in a
DMZ; all web/HTTP traffic must be able to reach this server. This server
happens to be running Microsoft’s IIS web server software, and an attacker
decides to directly attack the web server using web/HTTP traffic. Because the
attack targets vulnerabilities in IIS, the packets are allowed. So, although
packet filtering is not good security (on its own), it most certainly is another
technique that will increase the depth of your security.
Stateful Packet Inspection
Stateful Packet Inspection
This placement and added security allows for the defense in depth to be layered at yet another
level, with the goal of completely securing the network via multiple layers of protection.
SPI is usually implemented in a firewall so the TCP/IP connections can be inspected more
closely. Thus, this technology is considered connection aware in that SPI monitors and
understands that a connection between two computers usually consists of many packets that
flow back and forth between the computers. Stateful inspection of packets occurs during the
first packets that are used to create this connection. As the connection is inspected, an entry is
created in a table. Then, as future packets are received, they are verified against entries in this
table to see whether they belong to an existing and recorded connection. If the packets pass
this verification phase, they are allowed to pass. At a very high level, that is how SPI occurs.
Detailed Packet Flow Using SPI
1. When a packet arrives at the firewall, a decision must be made to
determine whether the packet should be allowed (forwarded) to the
internal network.
2. The device performing the stateful packet inspection takes each arriving
packet and inspects its headers to determine whether they match the set
of rules that control what kind of packets are allowed.
3. When inspecting the packet’s headers, the inspection includes the
packet’s source and destination addresses, its protocol type (TCP, UDP,
ICMP, and so forth), its source and destination ports, flags set on the
packet (SYN, ACK, FIN, RST, and so on), or other such basic header
information. Incoming packets are inspected until enough information has
been gathered from the packets received (using information such as TCP
sequence numbers) to determine the connection’s “state.”
Detailed Packet Flow Using SPI
4. This inspection data is compared against the rule set that has determined
what should be allowed and what should be denied. For example, all HTTP
traffic only might be allowed to a web server, while other traffic should be
denied trying to access the web server. This is a common rule wherein only a
certain type of traffic should only be allowed to a certain server.
5. Depending on the connection status, this inspection information is then
compared to a stateful table that would have entries for each TCP/IP
connection the device has allowed. For example, most devices allow everyone
from inside the network to access anything they want outside the network,
and that connection would have formed an entry in the state table. Rather
than allowing all packets that meet the rule set’s requirements to pass, only
those packets that are part of a valid, established connection are permitted.
Detailed Packet Flow Using SPI
6. Ultimately, packets are either permitted or denied depending on these
inspection steps. Because these rules/tables are only consulted once,
complex inspection rules do not greatly impact performance.
Limitations of Stateful Packet Inspection
Although SPI devices have improved scalability and benefits over packet filtering, they are not
the ultimate point of protection for your network. Consider the following two major
disadvantages of stateful packet inspection:
• No application level inspection—SPI cannot look at a packet any higher than Layer 4 of the
OSI reference model. In practice, this is how attacks are able to succeed against servers that
are accessible in some manner and protected by
firewalls performing stateful packet inspection.
• No connection state for every TCP/IP protocol—Certain protocols within TCP/IP have no
method of tracking the state of their connection between
computers. Specifically, ICMP or UDP have no connection state; thus, in the layered model,
these protocols should be subjected to packet filtering because they have no connection
state to track.