6.2Perimeter defense

Perimeter defense is not about "putting up a single wall and being done"—the core of the practice is applying defense in depth, placing multiple defense mechanisms of different natures at the appropriate points. A network specialist must be able to design decisions according to requirements and risk: where to place externally published servers, which layer a firewall should inspect, and how to prepare for attacks specific to web applications.

6.2.1Three firewall approaches

• Packet filtering is the most basic approach, judging whether to pass a packet using only header information such as IP address, port number, and protocol type. It is fast, but has the weakness that it cannot judge whether a response packet is legitimate, since it does not track the context (session state) of the communication.
• Stateful inspection remembers the session state of a communication (such as the progress of a TCP three-way handshake) and judges the legitimacy of response packets based on that context. It can apply dynamic rules such as "allow only return traffic corresponding to an outbound request," making it more secure than plain packet filtering.
• An application gateway (application-level gateway) is a proxy-style firewall that inspects content up to the application layer while relaying communication. It can inspect content down to the HTTP method or URL path, but the processing load is higher and performance is lower than the other approaches.