Where Application Firewalls Fit in a Network

The closer you come to the resource that needs to be protected, the more intelligent and specific you can get in filtering traffic directed at that resource.
Nội dung trích xuất từ tài liệu:
Where Application Firewalls Fit in a NetworkWhere Application Firewalls Fit in a NetworkThe closer you come to the resource that needs to be protected, the more intelligent andspecific you can get in filtering traffic directed at that resource. Because applicationfirewalls enable you to perform deep packet inspection and filter based on the rawapplication data, they are best suited for implementation close to the resources theyprotect. There are a couple of reasons for this.First, many application firewalls cannot filter traffic for which a proxy does not exist. Asa result, if an application firewall receives traffic that it cannot proxy, it is forced to dropthe traffic. The closer to the resources being protected that the application firewall isimplemented, the less the likelihood is that it will have to deal with traffic other thantraffic that is actually destined for the protected resource.Second, because application firewalls typically perform a more detailed inspection of thedata, they perform worse than a comparable stateful packet-filtering firewall. By placingthe firewall closest to the resources being protected, you reduce the volume of extraneoustraffic that the firewall must filter, thus preventing the firewall from becoming aperformance bottleneck.Application firewalls are most commonly implemented in a dual-firewall architecture asthe interior firewall. This setup allows the firewall to perform the most in-depthinspection of the traffic that is actually destined for your internal network.