Invisible Firewalls?
When adding a traditional hardware based firewall to a network, major network based surgery is needed a majority of the time. The potential for configuration problems with both internal clients and the router/proxy are increased. There is also overhead that goes into processing each packet or session for the firewall, making it difficult to come to an informed decision.
When looking though the eyes of an attacker, only minimal investigation and enumeration is needed to identify a device that is acting as a firewall. Its rule-set or “protection” features can be realized.Most firewalls operate at layer 3 of the OSI model, which forces them to route data after the rule-set has been applied. What if there was some way to simplify the inspection process for a traditional firewall? If we take a step down on the OSI model to layer 2, we will be inspecting frames instead of packets and the filtering decision can still be made without the need for routing. This type of device is called a transparent firewall.
Most of the benefits of utilizing a transparent firewall come from its ability to act as a bridge. When installing one on the network, there is nearly no configuration that needs to be done to other devices. You simply drop it in the way of whatever you want to protect and "bang" it filters traffic: no subnetting, no gateway changes, no routing protocols — just it and the frames.
There are also significant advantages gained in the performance of this type of firewall. With resources freed up, deeper examination of the data can be done without having to worry about pesky network bottlenecks.
For me, the greatest aspect of this type of device is its ninja-like “steathiness”. It does not require an IP address to to operate. It is virtually unreachable and invisible to the outside world. How do you port scan, firewalk, or cause a denial of service condition on a device that does not have an good network ip address?
Transparent firewalls are excellent security tools when they are used in the right situations. They allow rapid deployment along with deep analysis capabilities, while staying hidden to the outside world.
In my mind, these in-line devices represent several features that are what tomorrow’s network devices will be capable of doing on a grand scale.
What do you think?
Rodney Visser
Subscribe to comments via RSS 2.0 
You can leave a response, or trackback from your own site.
