Nokia IP60 User Manual page 33

Old Firewall Technologies
Older firewall technologies, such as packet filtering and application-layer gateways, are still in use in some
environments. It is important to familiarize yourself with these technologies, so as to better understand the
benefits and advantages of the Check Point Stateful Inspection firewall technology.
Packet Filters
Historically implemented on routers, packet filters filter user-defined content, such as IP addresses. They
examine a packet at the network or transport layer and are application-independent, which allows them to
deliver good performance and scalability.
Packet filters are the least secure type of firewall, as they are not application-aware, meaning that they
cannot understand the context of a given communication. This makes them relatively easy targets for
unauthorized entry to a network. A limitation of this type of filtering is its inability to provide security for
basic protocols.
Packet filters have the following advantages and disadvantages:
Table 7: Packet Filter Advantages and Disadvantages
Advantages
Application independence
High performance
Scalability
Application-Layer Gateways
Application-layer gateways improve security by examining all application layers, bringing context
information into the decision-making process. However, the method they use to do this disrupts the
client/server model, reducing scalability. Ordinarily, a client sends requests for information or action
according to a specific protocol, and the server responds, all in one connection. With application-layer
gateways, each client/server communications requires two connections: one from a client to a proxy, and
one from a proxy to a server. In addition, each proxy requires a different process (or daemon), making
support for new applications a problem.
Application-layer gateways have the following advantages and disadvantages:
Table 8: Application-Layer Gateway Advantages and Disadvantages
Advantages
Good security
Full application-layer awareness
Chapter 2: Security
Disadvantages
Low security
No screening above the network layer
Disadvantages
Poor performance
Limited application support
Poor scalability (breaks the client/server model)
The Nokia IP60 Firewall
33