Re: stealth firewalls

[Peter Lukas <plukas () oss uswest net>]

A knee-jerk pre-coffee thought is that these types of firewalls can
represent a breach in connectivity from a networking perspective. since
they transparently analyze and permit/deny/reject/encrypt/scan traffic,
the saturation point may interfere with traffic flow. As they may also be
installed as a "tap" on the line, having problems with the device may
knock out connectivity (so can gateway firewalls/routers/etc, though).

It represents an ideal firewall insertion scenario as the network doesn't
need to be re-IP'd or re-routed since the magic box sits relatively
invisibly on the wire.

I've run it in Small Office/Home Office DSL/cablemodem/ISDN settings with
good success using both FreeBSD and Linux. One thing to note is that under
linux, some network adapter drivers (Linux's 8139too) don't take well to
this and may drop more traffic than they allow.

Peter

Standard Disclaimer:
"This message has not been screened with /bin/lawyer and has potential to
ignite flames from overzealoused know-it-all's."

On Wed, 16 Jan 2002, Irwin Lazar wrote:

> I'm reading up a bit on stealth mode firewalls and was wondering what the
> industry view is toward these types of boxes.  From my research, stealth
> mode firewalls act as LAN switches or bridges, and do not actively modify
> the packets they process (such as decrementing TTL).  Is this correct?
>
> It seems there are some obvious advantages to stealth mode firewalls since
> they are completely hidden at the IP layer, but I'm wondering if there are
> any significant drawbacks.  It seems that products are limited, only Sun's
> SunScreen & BSD Linux support this functionality.
>
> Any thoughts?
>
> Irwin
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () nfr com
> http://list.nfr.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards