H3C SecPath F1800-A Operation Manual page 13

Operation Manual - Getting Started
H3C SecPath F1800-A Firewall
The basic principle of packet filtering firewall is that: It filters packets through
configuring Access Control List (ACL), based on:
The source and destination IP address
The source and destination port number
IP identifier
Packet delivery direction
With moderate cost and simple design, the first generation firewall can be
implemented easily.
However, its disadvantages are obvious:
As the complexity and length of ACL increase, its filtering performance will
degrade greatly;
Static ACL rules are difficult to adapt to dynamic security requirement;
Packet filtering neither checks session state nor analyzes data. That is, it cannot
filter data at user levels, which helps the hacker to spoof. For example, an
intruder can configure his host IP address to a legal host IP address to pass
through packet filter.
II. The Second Generation Firewall——Proxy Firewall
The proxy service acts on application layer. In essence, a proxy takes over the
services between internal network users and external network users. The working
principle is that the proxy first checks the request from a user, if the authentication is
passed, it establishes connection with a genuine server and forwards the request, and
finally it sends back the request response.
The proxy firewall has higher security. It can completely control network information
exchange and session process.
However, it has obvious disadvantages:
Low processing speed due to software restriction
Vulnerable to DoS attack
Difficult to upgrade for requiring developing application proxy for each protocol
III. The Third Generation Firewall——Stateful Firewall
The stateful analysis technology is an extension of packet filtering technology (also
informally called "dynamic packet filtering"). When checking packets, packet filtering
based on connection state not only treats each packet as an independent unit, but
also takes its history association into account.
The basic principle is described as follows:
The stateful firewall uses various state tables to keep track of activated TCP
session and UDP pseudo session. Then ACL determines which sessions are
allowed to be established. Finally only the packets associated with allowed
sessions are forwarded.
1-6
Chapter 1 Firewall Overview