1 / 34

Firewalls and VPNS

Team 9 Keith Elliot David Snyder Matthew While. Firewalls and VPNS. Firewall. Provides a barrier and/or filter between networks Can be configured to block packets Sometimes called a level 4 switch. Hardware Firewalls. Stateless Packet Filters

derron
Download Presentation

Firewalls and VPNS

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Team 9 Keith Elliot David Snyder Matthew While Firewalls and VPNS

  2. Firewall • Provides a barrier and/or filter between networks • Can be configured to block packets • Sometimes called a level 4 switch

  3. Hardware Firewalls • Stateless Packet Filters • Evaluates each packet against a set of rules • Stateful Packet Filters • Evaluates connection attempts and monitors flow

  4. Software Firewalls • Application • Operates at the application level by examining data before being passed down • Proxy-Based • Is a service that generally runs on a server that handles all requests • See next slide

  5. Proxy Server • The specific firewall in the OpNet lab is a gateway (i.e. a router) running a Proxy Server. A client requests a service from the proxy server, which evaluates the request. If it is determined to be valid, the proxy server makes the service request on behalf of the client. • The proxy server can be disabled for specific applications (HTTP, Database, Email, etc.)‏

  6. VPN • VPN (Virtual Private Network) • Acts as a private network connection (inside a company for example) while running over a more public internet. • Uses IP Tunneling.

  7. Advantages: Firewall and VPN • Firewalls • Provides protection to network resources by restricting access based upon information contained in packets • Common Use: Allows the separation of Intra-nets from the Internet • VPN • Allows access through firewalls by creating virtual circuits using tunneling. • Common Use: Provides secure remote access to an institution's protected resources

  8. Tunneling • Wraps an IP frame inside another frame of the same layer. • An IP frame inside another IP frame. • The inner packet can be encrypted, which allows for privacy of the connection. • You may remember IP6 was tested by tunneling inside IP4 packets.

  9. Disadvantages: VPNs • Tunneling increases the length of IP packets • May result in inefficient use of bandwidth, especially for short packets • Potential performance impact at end routers as they need to do more work • Remove headers, decrypt packet body‏ • Administrative overhead and cost associated with managing the VPN server

  10. Scenario 1- No Firewall

  11. Scenario 1 - Described • Simulates two sales people working offsite • Characterized by light Web Browsing and light Database access • Connect to a server via the Internet. s

  12. Scenario 2- Firewall

  13. Scenario 2- Described • Replaces the simple router previously used to connect to the server with a firewall • Configured to block Database access. • The Sales people can still engage in Web Browsing

  14. Scenario 3- Firewall with VPN

  15. Scenario 3- Described • Scenario 3 configures a VPN for Sales A • Sales A now tunnels through the firewall and can access the database • Still allowing web browsing • Sales B is restricted to web browsing with no database access.

  16. Results • Average Client DB and Client HTTP Traffic for the three scenarios. Show live.

  17. Exercises 1 & 2 • Explain the effect of the firewall, as well as the configured VPN, on the database and HTTP traffic requested by Sales A and Sales B.

  18. Exercises 1 & 2 - Observations • From the captured graphs, it can be observed that without the firewall both Sales A and Sales B clients were able to access the database, while adding the firewall prevented both Sales clients from accessing it. Configuring the VPN access for Sales A allowed it to access the database through the firewall. • Comparing the graphs of received HTTP and database traffic for both Sales A and B clients confirms that both clients receive HTTP traffic in all scenarios (i.e., the firewall permits HTTP traffic from both Sales clients). Once the firewall is in place however, database traffic is only permitted through the firewall using a VPN.

  19. Exercise 3 • Generate and analyze the graph(s) that show the response time for DB Queries and HTTP requests.

  20. Exercise 3- DB Queries

  21. Exercise 3- DB Queries • Obviously there is no DB Query response times for the Firewall without VPN • Firewall with VPN response time is slower due to overhead from the VPN and additional router.

  22. Exercise 3- HTTP

  23. Exercise 3 - HTTP • It was observed that the inclusion of the firewall did not add to the response time of the HTTP traffic. The additional inclusion of the VPN increased the response time of the traffic.

  24. Exercise 4 • Create a diagram that allows database access and no HTTP access to Sales A and HTTP access and no Database access to Sales B.

  25. Exercise 4

  26. Exercise 4 • Two additional firewall nodes were added, Router E and Router F. • The previous VPN runnel was changed from between Router A and Router D to between Router A and Router E. • A second VPN tunnel was then configured between Router B and Router F with the remote client set as Sales B. • Router E was then configured to allow database access but block HTTP access and Router F was configured to allow HTTP but block database access.

  27. Exercise 5 • Configure Encryption over the VPN. Study Sales A DB response times.

  28. Exercise 5

  29. Exercise 5 • You can see DB Query response time is increased with encryption. • As Sales A is the only one with DB Access, his response time should be identical to global response time and in fact they are.

  30. Other Things We Tried:Restricting VPN Connections • VPN is an application with IP traffic itself, and it therefore should be able to blocked by the Firewall. And it can. If you duplicate the Firewall with VPN and configure the Firewall to block “Other Applications”, Sales A can no longer make DB Query or HTTP requests. • This is because Sales A's VPN in Compulsory. Set it to Voluntary and Sales A can make HTTP requests like Sales B by not using the VPN.

  31. Other Things We Tried:VPN Impact on Network Traffic • Implementing a VPN should increase the volume of network traffic as all tunneled IP packets will be encapsulated inside the data portion of new packets. These packets will have the end router’s address as their destination. • To confirm this in the lab, we measured the throughput of the network link from Router A to the Internet to see how implementing a VPN impacted the total network traffic

  32. Other Things We Tried:VPN Impact on Network Traffic

  33. Other Things We Tried:VPN Impact on Network Traffic • The rate of data sent to from Router A to the Internet is higher when the data is tunneled using the VPN • The is caused by the additional IP headers that are added by the VPN

  34. Other Things We Tried:VPN Impact on Network Traffic • The rate at which data is received from the Internet into Router A is also higher when the data is tunneled using the VPN • The percentage increase that the VPN adds for the responses is lower than when sending data. This is a result of the responses are typically larger in size (e.g., database queries are typically shorter than the results etc.)

More Related