Cyberstudy
PDF p.134 In progress

Layer 4 and Layer 7 Firewalls

Open PDF at p.134 20 flashcards

Summary

PDF p.134

Layer 4 and Layer 7 firewalls enhance security by inspecting network traffic at different layers of the OSI model. Layer 4 firewalls focus on the transport layer, tracking TCP and UDP sessions, while Layer 7 firewalls inspect application-layer packets, ensuring the application protocol matches the expected port and analyzing payloads for threats.

In plain words

Supplementary — not from your PDF

A stateless firewall judges each packet on its own. A stateful firewall remembers connections in a state table, so replies to allowed sessions pass automatically. Layer 4 firewalls understand TCP handshakes and UDP flows and can spot flooding and sequence anomalies. Layer 7 (application-aware) firewalls read the application data itself. They check that traffic on a port really is the expected protocol and look for threats in the payload.

Detailed explanation

PDF p.134
  • Stateless vs. Stateful Firewalls
    • Stateless Firewalls
      • Definition: Do not preserve session information.
      • Operation: Analyze each packet independently.
      • Vulnerabilities: Susceptible to attacks spread over multiple packets.
      • Traffic Flow Issues: Problems with load balancing and dynamic ports.
    • Stateful Inspection Firewalls
      • Definition: Track session information between hosts.
      • Operation: Store session data in a state table.
      • Packet Handling: Check if a packet belongs to an existing connection; apply filtering rules if not.
      • Efficiency: Allow traffic to pass unmonitored once a connection is established.
  • Layer 4 Firewalls
    • OSI Layer: Transport layer.
    • TCP Handshake: Examines SYN > SYN/ACK > ACK sequence to distinguish new from established connections.
    • Anomaly Detection: Drops packets with sequence anomalies or malicious flooding attempts.
    • Response: Can block source IP addresses and throttle sessions.
    • UDP Traffic: Tracks UDP traffic, though more challenging due to connectionless nature.
    • Additional Detection: IP header and ICMP anomalies.
  • Layer 7 Firewalls
    • OSI Layer: Application layer.
    • Packet Inspection: Inspects headers and payloads of application-layer packets.
    • Protocol Verification: Ensures application protocol matches the expected port.
    • Threat Detection: Analyzes HTTP headers and webpage formatting to identify threats.
    • Application-Aware Firewalls: Also known as application layer gateway, stateful multilayer inspection, and deep packet inspection.
    • Configuration: Separate filters for each type of traffic (HTTP, HTTPS, SMTP/POP/IMAP, FTP).

Important terms

taken from the text above
Stateless Firewalls
Do not preserve session information.
Traffic Flow Issues
Problems with load balancing and dynamic ports.
Stateful Inspection Firewalls
Track session information between hosts.
Packet Handling
Check if a packet belongs to an existing connection; apply filtering rules if not.
OSI Layer
Transport layer.
TCP Handshake
Examines SYN > SYN/ACK > ACK sequence to distinguish new from established connections.
Anomaly Detection
Drops packets with sequence anomalies or malicious flooding attempts.
UDP Traffic
Tracks UDP traffic, though more challenging due to connectionless nature.
Additional Detection
IP header and ICMP anomalies.
Packet Inspection
Inspects headers and payloads of application-layer packets.
Protocol Verification
Ensures application protocol matches the expected port.
Threat Detection
Analyzes HTTP headers and webpage formatting to identify threats.
Application-Aware Firewalls
Also known as application layer gateway, stateful multilayer inspection, and deep packet inspection.

Examples & real-world scenarios

Supplementary — not from your PDF
  • A stateful firewall allowing return traffic for a user's web session.
  • A layer 7 filter spotting non-HTTP traffic on port 80.
  • Separate application filters for HTTP, SMTP and FTP.

Scenario

Some traffic uses TCP 443 to slip past a port-based rule set. Only a layer 7 (application-aware) firewall can notice that the traffic isn't really HTTPS.

Common mistakes

Supplementary — not from your PDF
  • Assuming stateful means application-aware. Stateful tracks sessions (layer 4); application awareness is layer 7.
  • Forgetting the other names for layer 7 firewalls: application layer gateway, stateful multilayer inspection, deep packet inspection.

Practical skills

Supplementary — not from your PDF
  • Explain stateless vs stateful filtering.
  • Choose a layer 4 or layer 7 firewall for a requirement.

What I should remember

Key Points PDF p.134
  • Stateless vs. Stateful Firewalls
    • Stateless: Independent packet analysis, vulnerable to multi-packet attacks.
    • Stateful: Tracks sessions, uses state table, efficient traffic handling.
  • Layer 4 Firewalls
    • Transport Layer: TCP handshake, anomaly detection.
    • Response: Block IPs, throttle sessions.
    • UDP Traffic: Connectionless tracking, IP/ICMP anomalies.
  • Layer 7 Firewalls
    • Application Layer: Header and payload inspection.
    • Protocol Verification: Matches application protocol to port.
    • Threat Detection: Analyzes HTTP headers, webpage formatting.
    • Application-Aware: Multiple names, separate traffic filters.