You may also want information about all of the NAT translations the firewall has done and all administrative activities are done to the firewall. In most cases, you’ll also want to log information about unsuccessful sessions through the firewall. A firewall should be capable of logging information about every successful session.

In many cases, I also want to make internal resources publicly accessible, which again means I need to create a mapping rule that associates the internal resource with a public IP address. So when forwarding a packet out to the Internet, the firewall needs to replace private addresses with public addresses that can be routed on the Internet. At a minimum, I want to hide internal private addresses from the Internet.

Network address translation is a pretty well-understood concept.This information could include IP addresses, protocols, or port numbers. Network Layer access controls are simple rules that permit or deny traffic based on information in the packet headers.But after my session ends and the firewall is no longer expecting those inbound packets, it should block them. If I’m allowed to make an outbound connection to a website on the Internet, the state table knows it should allow inbound packets back from the same site.

Stateful in this context means the firewall keeps a table of every active session passing through it.

And one of the most important yet most overlooked features of a basic firewall is that it must include extensive logging. It’s also able to do network address translation (NAT). First, a few words about basic firewallsĪt its most basic (and I’ll explain all the terms in a moment) a firewall is a stateful device that can apply network layer access control to packets passing through it. You’ll also see the term unified threat management (UTM) to describe what is essentially the same thing.īelow, I’ve put together a shopping list of features that are often included in next-gen firewalls so you can understand the options and make sure the ones relevant to your client networks are covered by the device you’re looking at. A next-generation firewall is a marketing term, so there’s no single, clear definition of this sort of device.

Bluestacks login google play