[113213] in North American Network Operators' Group
Re: ACLs vs. full firewalls
daemon@ATHENA.MIT.EDU (Karl Auer)
Tue Apr 7 18:38:57 2009
From: Karl Auer <kauer@biplane.com.au>
To: nanog@nanog.org
In-Reply-To: <20090408070402.a73638d7.nanog@85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org>
Date: Wed, 08 Apr 2009 08:32:02 +1000
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
--=-lszVWDlV0tyEE5ocTSMl
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
On Wed, 2009-04-08 at 07:04 +0930, Mark Smith wrote:
> It seems there is a trend towards moving host protection on to the
> hosts themselves, onto or closer to the resource or entity being
> protected. It's basically following the cliche, "If you want something
> to be done properly, you need to do it yourself."
And IPv6 tends to push security back onto hosts, too.
> If you move to the host-based firewalling model, plain packet
> filtering ACLs at the perimeter would be quite an adequate form of a
> first level of defence, while also avoiding the performance overhead
> of (or resources required to perform) stateful tracking of large
> amounts of traffic.=20
And a combination of the two - if you *are* performing more complex
checks deeper inside the network, packet filtering can reduce the load
that actually reaches those inner check points.
I'd be interested to hear why people use firewalls. I've never felt the
need, myself - am I living in a fool's paradise?
Regards, K.
--=20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (kauer@biplane.com.au) +61-2-64957160 (h)
http://www.biplane.com.au/~kauer/ +61-428-957160 (mob)
GPG fingerprint: 07F3 1DF9 9D45 8BCD 7DD5 00CE 4A44 6A03 F43A 7DEF
--=-lszVWDlV0tyEE5ocTSMl
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQBJ29RhSkRqA/Q6fe8RAlljAKCFu1SmmAoGoEMR5VK5ingwWUq+5QCg4UKb
oYP6Q6MM6DLbGG8hAuXAx+k=
=XAum
-----END PGP SIGNATURE-----
--=-lszVWDlV0tyEE5ocTSMl--
