Firewall is the most critical part of any network and it plays an important role in the security of network. Before selecting any firewall you should have to check and get the appropriate answers of these critical questions, which will help a lot in selecting an appropriate firewall defending your network as a perimeter line of defense against the attacks.but the most important thing is that your business need and your organizations security policy which drives you to purchase the firewall and then finally is your part selecting best firewall in the world
CISCO Firewall (PIX and ASA) PIX/ASA is truly stateful firewall with rich application and protocol inspection including UDP. In order to monitor the state of UDP conversations, the PIX /ASA supports the stateful failover protocols: IPSec, IKE , All TCP, All UDP 1. Firewall (application awareness , Statefull inspection)
1) Any type of application awareness does your firewall support?
2) Is your firewall really a state full and it can watch UDP Sessions as well?
3) Dose this firewall watch application level traffic? As it can see an FTP, TFTP, HTTP session and limit FTP commands can be used?
4) Dose that firewall have capability to stop or defend against web attacks like cross site scripting?
5) Dose your firewall provides Intrusion prevention?
6) Reporting options available in the firewall?
7) Can this firewall capable to detect and block P2P (peer to peer) applications?
8) Firewall product protect from VPN attacks?
9) Protection against TCP based traffic?
10) Protecting against rapid scanning events i.e. spoofing, scanning , brute force?
11) DOS and DDOS protection?
12) Any protection at application level for HTTP, SMTP, POP3, HTTPS applications?
13) Any type of protection for DNS, Microsoft Network System, instant messaging and VOIP?
14) any protection at web application level, in which your product run scripts in a safe environment to determine if the code is malicious before allowing the user to execute it?
15) Dose this product offer contact filtering based upon URL's?
16) VPN options supported by the device like site to site, remote access, SSL?
17) How fast the patches are updated in the case of identification of vulnerability?
18) Check the performance data from the data sheets, and any test reports?
19) I/O interfaces option (that depends upon your requirement?
A firewall is the guarantee of a secure network. In order to provide reliable security firewall security itself is a primary concern in this regard there are multiple solutions being offered by Cisco , However Firewall security becomes a transparent, scalable, and manageable aspect of the business infrastructure.
The new product introduces by cisco a couple of years back replacing PIX and is ASA. Adaptive Security Algorithm is used by the PIX/ASA security appliances for stateful application inspection and facilitates to secure use of applications and services. Some applications require special handling by the security appliance and specific application inspection engines are provided for this purpose.
Some of protocols supported by CISCO ASA application inspection is as under however it keeps on increasing day by day (I have tried my level best to identify every protocol):
FTP, SUN RPC, SQL*NET, SCCP, MGCP, Exchange, NetShow, VDOLive, GTP (3G Wireless), CTIQBE, PPTP, RSH, SIP, H.323,NAT/PAT of DNS, FTP, ICMP, ESP-IKE, ILS, SIP, X Display, SCCP (Skinny), RTSP, TAPI/JAPI.
Cisco Firewall watches application-level traffic. In the case of FTP it will inspects the FTP sessions and performs preparation of dynamic secondary data connection than Tracks FTP command-response sequence , produces audit trail and finally NAT embedded IP address
Intrusion prevention module in the ASA is both signature and pattern based, this IPS module can also use the Meta Event Generator to determine if certain behaviors are undesired and make an inline permit/deny action and can be integrated with different reporting and management systems .
PIX/ASA 7.0 provides visibility and control of Instant Messaging, Peer-to-Peer, and other tunneling applications (As GoToMyPC.com). in order to protect against the successive attacks like continous scan cisco ASA have a great command # ip verify reverse path , beside this you can limit embryonic connections both TCP and UDP to avoid DOS attack
HTTP inspection provides some additional facilities
DNS attacks are more command now a days so DNS query inspection in cisco PIX /ASA which tears down the DNS session associated with a DNS query as soon as the DNS reply is forwarded by the security appliance. DNS guard also monitors the message exchange to verify that the ID of the DNS reply matches the ID of the DNS query
Cisco Firewall supports main features that provides protection
2. Unified communication Security
3. SSL/IPSec VPN
4. Intrusion prevention
5. Content Security
Summarized Data Sheet of Cisco ASA appliance is as under:--
CISCO Firewall (PIX and ASA)
PIX/ASA is truly stateful firewall with rich application and protocol inspection including UDP. In order to monitor the state of UDP conversations, the PIX /ASA supports the stateful failover protocols: IPSec, IKE , All TCP, All UDP
1. Firewall (application awareness , Statefull inspection)
Reference: - http://www.cisco.com/