Tài liệu How the PIX/ASA Firewall Works ppt

How the PIX/ASA Firewall Works

Note

With the implementation of the PIX and ASA software starting with version 7.0, many of

the features and functionality of the firewall were changed dramatically. Version 7.0 was

truly a major design shift. This chapter is written to include the 6.x software because, in

addition to the new 7.x software, that is the version of software that most Cisco PIX

firewalls are running. Where possible, we point out the new/changed features, commands

and functionality that is provided via the 7.0 code. If no note specifies which version of

software a command functions on, that means that the command is the exact same

regardless of whether the firewall is running 6.x or 7.x software. For more detailed

information about PIX 7.0 code, refer to the Cisco ASA and PIX Firewall Handbook

(Cisco Press).

Fundamentally, the PIX/ASA firewall functions by filtering traffic that is transmitted

through the firewall across the firewall interfaces. This allows the PIX/ASA to protect

hosts and networks from unauthorized access while still permitting access that is deemed

(and defined) by the administrator as acceptable. The firewall functionality performs

these tasks by parsing a security policy, functioning in a firewall mode of operation, and

performing stateful inspection of the data.

Firewall Security Policy

The firewall security policy (not to be confused with the general security policies

discussed in Chapter 10, "Firewall Security Policies") on the PIX firewall is what

determines the traffic that will be permitted or denied by the firewall. To facilitate this,

the PIX implements a combination of the following elements to assist in making filtering

decisions:

• Separate the network into zones based on security levels

• Use ACLs to permit or deny traffic

• Apply Network Address Translation (NAT)

• Apply authentication, authorization, and accounting (AAA) for through traffic

• Apply web or FTP filtering

In addition, the Cisco ASA can perform the following:

• Use the Advanced Inspection and Prevention Security Services Module (AIP

SSM) to perform deep packet inspection on the data. The AIP SSM is beyond the