The document provides an overview of various network security devices and concepts. It describes routers and how they use access control lists to filter network traffic. It also explains firewalls, how they can be implemented as hardware or software, and the technologies they use including network address translation, packet filtering, and access control lists. Finally, it covers intrusion detection systems, the differences between network-based and host-based IDS, and how honeypots are used to detect attackers on a network.

1. GUIDE TO PROTECTING
NETWORKS
ERIC VANDERBURG

2. OBJECTIVES
2
• Describe network security devices
• Describe firewall technology
• Describe intrusion detection systems
• Describe honeypots

3. 3
UNDERSTANDING NETWORK
SECURITY DEVICES
• Network security devices
• Routers
• Firewalls
• Intrusion detection systems
• Honeypots

4. 4
UNDERSTANDING ROUTERS
• Routers are hardware devices used on a network to
send packets to different network segments
• Operate at the network layer of the OSI model
• Routing protocols used by routers
• Link-state routing protocol
• Router advertises link-state to identify network topology and
any changes on paths
• Distance-vector routing protocol
• Router passes its routing table to all routers participating on
the network

5. 5
UNDERSTANDING BASIC
HARDWARE ROUTERS
• Cisco routers are widely used in the networking
community
• More than one million Cisco 2500 series routers are
currently being used by companies around the world
• Vulnerabilities exist in Cisco as they do in any
operating system
• Security professionals must consider these vulnerabilities
when conducting a security test

6. 6
CISCO ROUTER COMPONENTS
• A Cisco router uses the Cisco Internetwork
Operating System (IOS) to function
• Components
• Random access memory (RAM)
• Holds the router’s running configuration, routing tables, and
buffers
• If you turn off the router, the contents stored in RAM are
wiped out
• Nonvolatile RAM (NVRAM)
• Holds the router’s configuration file, but the information is
not lost if the router is turned off

7. 7
CISCO ROUTER COMPONENTS
(CONTINUED)
• Components (continued)
• Flash memory
• Holds the IOS the router is using
• Is rewritable memory, so you can upgrade the IOS
• Read-only memory (ROM)
• Contains a minimal version of the IOS used to boot the router
if flash memory gets corrupted
• Interfaces
• Hardware connectivity points
• Example: an Ethernet port is an interface that connects to a
LAN

8. 8
CISCO ROUTER CONFIGURATION
• Configuration modes:
• User mode
• Administrator can perform basic troubleshooting tests and list
information stored on the router
• Router-name>, indicates that you are in user mode
• Privileged mode
• Administrator can perform full router configuration tasks
• Router-name#, indicates that you are in privileged mode
• By default, you are in user mode
• Type “enable” or “en” to change to privileged mode

9. 9
CISCO ROUTER CONFIGURATION
(CONTINUED)
• Once in privileged mode, you can change to two
more configuration modes
• Global configuration mode
• Administrator can configure router settings that affect overall
router operation
• To use this mode, you enter the command config t at the
Router-name# prompt
• Router-name (config)# tells the user she is in global
configuration mode

10. 10
CISCO ROUTER CONFIGURATION
(CONTINUED)
• Once in privileged mode, you can change to two
more configuration modes (continued)
• Interface configuration mode
• Administrator can configure an interface on the router
• To use this mode, you enter global configuration mode first
• Next, you enter the command for interface configuration
mode and the interface name you want to configure
• Router-name(config-if)# indicates you are in interface
configuration mode

11. 11
UNDERSTANDING ACCESS
CONTROL LISTS
• There are several types of access control lists
• We will focus on IP access lists
• IP access lists
• Lists of IP addresses, subnets, or networks that are allowed
or denied access through a router’s interface
• Two different types of access lists on Cisco router
• Standard IP access lists
• Extended IP access lists

12. 12
STANDARD IP ACCESS LISTS
• Can restrict IP traffic entering or leaving a router’s
interface based on source IP address
• The syntax of a standard access list is as follows:
access-list [list #] [permit|deny] [source address]
[source wildcard mask]
• [list #] is a number in the range of 1 to 99
• permit | deny] are keywords to permit or deny traffic
• [source address] specifies the IP address of the source host
• [source wildcard mask] signifies which bits of the source
address are significant

13. 13
STANDARD IP ACCESS LISTS
(CONTINUED)
• Example:
access-list 1 deny 173.110.0.0 0.0.255.255
access-list permit any
• A wildcard mask is similar to a subnet mask
• Example: access-list 1 deny 10.10.1.112 0.0.0.0
• The 0s used after the IP address signify that every octet in
the IP address must match the IP address being filtered
• Another example:
access-list 1 deny 192.168.10.0 0.0.0.255
access-list 1 permit any

14. 14
STANDARD IP ACCESS LISTS
(CONTINUED)
• Cisco allows a shortcut for the mask 0.0.0.0
access-list 1 deny host 192.168.10.112
• Access lists always end with an implicit deny rule
• To avoid this, you must add the “permit any” statement
access-list 1 deny host 192.168.10.112
access-list 1 permit any
• Steps for applying the access list to an interface
• Enter global configuration mode
• Create the access list
• Enter interface configuration mode
• Use the ip access-group command

15. 15
STANDARD IP ACCESS LISTS
(CONTINUED)
• Example
Router> en
Password ******
Router# config t
Router(config)# access-list 1 deny 172.16.5.0 0.0.0.255
Router(config)# access-list 1 permit any
Router(config)# int e0
Router(config-if)# ip access-group 1 out
Router(config-if) Ctrl+z [to save and exit global
configuration mode]
Router#

16. 16
EXTENDED IP ACCESS LISTS
• Allow packet filtering based on
• Source IP address
• Destination IP address
• Protocol type
• Application port number
• Syntax for extended IP access lists
access-list [list #] [permit|deny] [protocol] [source IP
address] [source wildcard mask] [destination IP address]
[destination wildcard mask] [operator] [port] [log]
• [list #] is a number in the range of 100 to 199
• [permit | deny] are keywords to permit or deny traffic

17. 17
EXTENDED IP ACCESS LISTS
(CONTINUED)
• Syntax for extended IP access lists (continued)
• [protocol] can be IP, TCP, UDP, ICMP, and so on
• [source IP address] is the IP address of the source
• [source wildcard mask] determines significant bits of source
IP address
• [destination IP address] is the IP address of the destination
• [destination wildcard mask] determines significant bits of
destination IP address
• [operator] can be lt, gt, eq, or neq

18. 18
EXTENDED IP ACCESS LISTS
(CONTINUED)
• Syntax for extended IP access lists (continued)
• [port] port number of the protocol to be filtered
• [log] logs all activity of the access list for the administrator
• Example:
access-list 100 deny tcp host 172.16.1.112 host
172.30.1.100 eq www

19. 19
EXTENDED IP ACCESS LISTS
(CONTINUED)
• Applying an access list to an interface
Router> en
Password ******
Router# config t
Router(config)# access-list 100 deny tcp host
172.16.1.112 host 172.30.1.100
Router(config)# access-list 100 permit any
Router(config)# int e0
Router(config-if)# ip access-group 100 in
Router(config-if) Ctrl+z
Router#

20. 20
UNDERSTANDING FIREWALLS
• Firewalls are hardware devices or software installed
on a system and have two purposes
• Controlling access to all traffic that enters an internal
network
• Controlling all traffic that leaves an internal network
• Advantages of hardware firewalls
• They are usually faster than software firewalls
• They can handle a larger throughput than software firewalls

21. 21
UNDERSTANDING FIREWALLS
(CONTINUED)
• Disadvantage of hardware firewalls
• You are locked into the firewall’s hardware
• Advantage of software firewalls
• You can easily add NICs to the server running the firewall
software
• Disadvantage of software firewalls
• You might have to worry about configuration problems
• They rely on the OS on which they are running

22. 22
UNDERSTANDING FIREWALL
TECHNOLOGY
• Firewall technologies
• Network address translation (NAT)
• Access control lists
• Packet filtering
• Stateful packet inspection (SPI)

23. NETWORK ADDRESS TRANSLATION (NAT)
• The most basic security feature of a firewall
• With NAT, internal private IP addresses are mapped to public
external IP addresses
23
• Hiding the internal infrastructure
• Port Address Translation (PAT)
• Technology derived from NAT
• This allows thousands of internal IP addresses to be mapped to one
external IP address

24. ACCESS CONTROL LISTS
• Access lists are used to filter traffic based on source IP address,
destination IP address, and ports or services
• Firewalls also use this technology
• Creating access control lists in a firewall is a similar process to
creating them in a router
24

25. PACKET FILTERING
25
• Packet filters screen packets based on information
contained in the packet header
• Protocol type
• IP address
• TCP/UDP port

26. STATEFUL PACKET INSPECTION (SPI)
26
• Stateful packet filters record session-specific
information about a network connection
• Create a state table
• Can help reduce port scans that rely on spoofing or
sending packets after a three-way handshake
• Stateful packet filters recognize types of anomalies
that most routers ignore
• Stateless packet filters handle each packet on an
individual basis
• Spoofing or DoS attacks are more prevalent

27. IMPLEMENTING A FIREWALL
• Placing a firewall between a company’s internal network and
the Internet is dangerous
27
• It leaves the company open to attack if a hacker compromises the
firewall
• Use a demilitarized zone instead

28. DEMILITARIZED ZONE (DMZ)
• DMZ is a small network containing resources available to
Internet users
28
• Helps maintain security on the company’s internal network
• Sits between the Internet and the internal network
• It is sometimes referred to as a “perimeter network”

29. UNDERSTANDING THE PRIVATE INTERNET
EXCHANGE (PIX) FIREWALL
• Cisco PIX firewall
29
• One of the most popular firewalls on the market

30. CONFIGURATION OF THE PIX FIREWALL
• Working with a PIX firewall is similar to working with any other Cisco router
• Login prompt
30
If you are not authorized to be in this XYZ Hawaii network device,
log out immediately!
User Access Verification
Password:
• This banner serves a legal purpose
• General prompt example:
Type help or '?' for a list of available commands.
xyz>

31. CONFIGURATION OF THE PIX FIREWALL
(CONTINUED)
• You should enter privileged mode to configure the PIX firewall
• To enter configuration mode in PIX, you use the same command as
on a Cisco router
31
xyz# configure terminal
xyz(config)# ?
• Nameif is a PIX command to name an interface
• PIX allows the administrator to assign values to an interface that designate
its security level
• Values can be from 0 to 100

32. CONFIGURATION OF THE PIX FIREWALL
(CONTINUED)
• Access lists
32
• PIX enables an administrator to use descriptive names for the access list
instead of numbers
• PIX also uses the implicit deny rule

33. UNDERSTANDING MICROSOFT ISA
33
• Microsoft’s software approach to firewalls
• Microsoft Internet Security and Acceleration (ISA)
Server
• Functions as a software router, firewall, and IDS
• ISA has the same functionality as any hardware
router
• Packet filtering to control incoming traffic
• Application filtering through the examination of protocols
• Intrusion detection filters
• Access policies to control outgoing traffic

34. IP PACKET FILTERS
34
• ISA enables administrators to filter IP traffic based
on the following:
• Source and destination IP address
• Network protocol, such as HTTP
• Source port or destination port
• ISA provides a GUI for these configurations
• A network segment can be denied or allowed HTTP access
in the Remote Computer tab

35. APPLICATION FILTERS
• Can accept or deny data from specific applications or data containing
specific content
• SMTP filter can restrict
35
• E-mail with specific attachments
• E-mail from a specific user or domain
• E-mail containing specific keywords
• SMTP commands
• SMTP Filter Properties dialog box
• Administrator can filter a specific e-mail attachment based on a rule he or
she configures

36. APPLICATION FILTERS (CONTINUED)
• Users/Domains tab in the SMTP Filter Properties dialog box
36
• Administrator can filter e-mail messages sent from a user or from
specific domains
• As a security professional, you might be asked to restrict e-mails
containing certain keywords
• SMTP Commands tab
• Administrator can prevent a user from running SMTP commands

37. INTRUSION DETECTION FILTERS
• Analyze all traffic for possible known intrusions
37
• DNS intrusion detection filter
• POP intrusion detection filter
• FTP Access filter
• H.323 filter
• HTTP Redirector filter
• RPC filter
• SMTP filter
• SOCKSV4 filter
• Streaming Media filter

38. ACCESS POLICIES
• Allow administrators to control outgoing traffic
• An access policy consists of the following
38
• Policy rules
• Site and content rules
• IP filter rules

39. UNDERSTANDING INTRUSION DETECTION
SYSTEMS (IDSS)
• Monitor network devices so that security administrators can
identify attacks in progress and stop them
• An IDS look at the traffic and compare it with known exploits
39
• Similar to virus software using a signature file to identify viruses
• Types
• Network-based IDSs
• Host-based IDSs

40. NETWORK-BASED AND HOST-BASED IDSS
• Network-based IDSs
40
• Monitor activity on network segments
• They sniff traffic and alert a security administrator when something
suspicious occurs
• Host-based IDSs
• Used to protect a critical network server or database server
• The software is installed on the server you’re attempting to protect

41. NETWORK-BASED AND HOST-BASED IDSS
(CONTINUED)
• IDSs are categorized by how they react when they detect
suspicious behavior
41
• Passive systems
• Send out an alert and log the activity
• Active systems
• Log events and send out alerts
• Can also interoperate with routers and firewalls

42. UNDERSTANDING HONEYPOTS
• Honeypot
42
• Computer placed on the perimeter of a network
• Contains information intended to lure and then trap hackers
• Computer is configured to have vulnerabilities
• Goal
• Keep hackers connected long enough so they can be traced back

43. HOW THEY WORK
43
• A honeypot appears to have important data or
sensitive information stored on it
• Could store fake financial data that tempts hackers to
attempt browsing through the data
• Hackers will spend time attacking the honeypot
• And stop looking for real vulnerabilities in the company’s
network
• Honeypots also enable security professionals to
collect data on attackers
• Honeypots are available commercially and through
open-source avenues

44. HOW THEY WORK (CONTINUED)
• Virtual honeypots
44
• Honeypots created using software solutions instead of hardware devices
• Example: Honeyd

45. SUMMARY
45
• Security devices
• Routers
• Firewalls
• IDSs
• Routers use access lists to accept or deny traffic
through their interfaces
• Firewalls can be hardware devices or software
installed on computer systems
• Firewalls use NAT, IP filtering, and access control lists to
filter incoming and outgoing network traffic

46. SUMMARY (CONTINUED)
46
• Firewall examples
• Cisco PIX (hardware)
• Microsoft ISA (software)
• Stateful packet filters vs. stateless packet filters
• PGP is a free public key encryption program to
encrypt e-mail messages
• Demilitarized zones (DMZs)
• Add a layer of defense between the Internet and a company’s
internal network

47. SUMMARY (CONTINUED)
47
• Intrusion detection systems (IDSs)
• Network-based IDSs
• Host-based IDSs
• Passive IDSs vs. active IDSs
• Honeypots