345
Configuring a firewall
A firewall can block unauthorized accesses from the Internet to a protected network while allowing
internal network users to access the Internet through WWW, for example, or to send/receive email
messages. A firewall can also be used to control access to the Internet, for example, to permit only
specific hosts within the organization to access the Internet. Many of today's firewalls offer some other
features, such as identity authentication and security processing (encryption) of information.
Another application of firewalls is to protect mainframes and important resources (such as data) on the
internal network. Any access to protected data must be first filtered by the firewall, even if such an
access is initiated by a user within the internal network.
Presently, the router mainly implements three categories of firewalls:
•
ACL-based packet filtering
•
ASPF
•
Address translation
NOTE:
For details about address translation and NAT configuration, see
Layer 3—IP Services Configuration
Guide. This chapter focuses on ACL-based packet filtering firewall and ASPF.
Packet filtering firewall
A packet filtering firewall implements IP packet specific filtering. For each IP packet to be forwarded, the
firewall first obtains the header information of the packet, including the number of the upper layer
protocol carried by the IP layer, the source address, destination address, source port number, and
destination port number of the packet. Then, it compares the obtained header information against the
preset ACL rules and processes the packet according to the comparison result.
The current packet filtering firewall checks the following contents:
•
Packet type.
•
Layer 3 information of the packet, for matching against basic ACL rules and advanced ACL rules
without information of Layer 3 and above.
•
Upper layer Information, for matching against advanced ACL rules containing information of Layer
3 and above.
NOTE:
For details about ACL, see
ACL and QoS Configuration Guide.
