Guidelines on firewalls and firewall policy :
Julian Friedrich Wack, Ken Cutler, Jamie Pole · 2002
ment and those wishing to increase their knowledge of firewalls may find this document useful as well.This document assumes some knowledge of TCP/IP (Transmission Control Protocol/Internet Protocol), the protocol suite used by the Internet, as well as various other aspects of networking and information security.Less-technical readers may find Special Publication 800-10 a useful starting point for firewall concepts.1.3.Document Organization The remainder of this document is organized as follows: Chapter 2 contains a review of the Open Systems Interconnect (OSI) protocol stack and uses this to describe a number of different firewall platforms, including packet filter firewalls, stateful firewalls, and application-proxy firewalls.Chapter 3 describes various firewall environments, i.e., components that combined, consti- tute a firewall solution.It contains suggestions for positioning firewalls and enabling them to work in conjunction with other security tools.Chapter 3 also describes other aspects of modem firewalling such as Virtual Private Networks (VPNs), IP address translation, and filtering of content such as email attachments.Chapters 4 and 5 contain detailed information useful for those m ho administer firewalls and configure firewall policy.Chapter 4 describes firewall policy, how it should fit within an overall policy fi^amework, and then presents a suggested minimum policy that can be tai- lored to suit many environments.Chapter 5 presents suggestions for implementing and managing firewall administration.Appendix A defmes terminology used in this document.Appendix B contains resources and on-line links for more information about computer security in general and firewalls in particular.Appendix C summarizes recommendations contained in the main chapters and recommends additional firewall measures.Independent of firewall architecture, there can be many add-on services.Some of these services include Network Address Translation (NAT), Dynamic Host Configuration Protocol (DHCP), encryption functionality such as Virtual Private Networks (VPNs), and