Re: Stateful Perimeter Firewall

[Cal Frye <cjf () CALFRYE COM>]

Bruce Curtis wrote:
> In our environment a large percentage
> of the computers on our network, perhaps even a majority, leave campus
> every night and go somewhere beyond the "protection" of a perimeter
> firewall, and then they come back the next day.

We use multiple firewalls, defining the "perimeter" at several locations
in the network, depending on what we're protecting from whom. Not to
denigrate host-based solutions, but to augment them.

It's easier to identify an intrusion when one compromised machine is in
protected space than sorting it out from a sea of log entries -- you can
enhance the signal, or lower the noise.

--
Celebrating the 150th anniversary of the publication of the Origin of
Species.
-- Cal Frye, Network Administrator, Oberlin College
   Mudd Library, x.56930 -- CIT will NEVER ask you for your password!

   www.calfrye.com,  www.pitalabs.com

"When I can no longer bear my loneliness I take it to my friends."
--Mechtild of Magdeburg.