دانلود متن لاتین و ترجمه فارسی Internet Firewalls
| دسته بندی | کامپیوتر و IT |
| فرمت فایل | doc |
| حجم فایل | 213 کیلو بایت |
| تعداد صفحات فایل | 73 |
دانلود متن لاتین و ترجمه فارسی Internet Firewalls
21 صفحه متن لاتین Internet Firewalls
27 صفحه ترجمه Internet Firewalls
Internet Firewalls:
Frequently Asked Questions
3 Design and Implementation Issues
3.1 What are some of the basic design decisions in a firewall?
There are a number of basic design issues that should be addressed by the lucky person who has been tasked with the responsibility of designing, specifying, and implementing or overseeing the installation of a firewall.
The first and most important decision reflects the policy of how your company or organization wants to operate the system: is the firewall in place explicitly to deny all services except those critical to the mission of connecting to the Net, or is the firewall in place to provide a metered and audited method of ``queuing'' access in a non-threatening manner? There are degrees of paranoia between these positions; the final stance of your firewall might be more the result of a political than an engineering decision.
The second is: what level of monitoring, redundancy, and control do you want? Having established the acceptable risk level (i.e., how paranoid you are) by resolving the first issue, you can form a checklist of what should be monitored, permitted, and denied. In other words, you start by figuring out your overall objectives, and then combine a needs analysis with a risk assessment, and sort the almost always conflicting requirements out into a laundry list that specifies what you plan to implement.
The third issue is financial. We can't address this one here in anything but vague terms, but it's important to try to quantify any proposed solutions in terms of how much it will cost either to buy or to implement. For example, a complete firewall product may cost between $100,000 at the high end, and free at the low end. The free option, of doing some fancy configuring on a Cisco or similar router will cost nothing but staff time and a few cups of coffee. Implementing a high end firewall from scratch might cost several man-months, which may equate to $30,000 worth of staff salary and benefits. The systems management overhead is also a consideration. Building a home-brew is fine, but it's important to build it so that it doesn't require constant (and expensive) attention. It's important, in other words, to evaluate firewalls not only in terms of what they cost now, but continuing costs such as support.
On the technical side, there are a couple of decisions to make, based on the fact that for all practical purposes what we are talking about is a static traffic routing service placed between the network service provider's router and your internal network. The traffic routing service may be implemented at an IP level via something like screening rules in a router, or at an application level via proxy gateways and services.
The decision to make is whether to place an exposed stripped-down machine on the outside network to run proxy services for telnet, FTP, news, etc., or whether to set up a screening router as a filter, permitting communication with one or more internal machines. There are benefits and drawbacks to both approaches, with the proxy machine providing a greater level of audit and, potentially, security in return for increased cost in configuration and a decrease in the level of service that may be provided (since a proxy needs to be developed for each desired service). The old trade-off between ease-of-use and security comes back to haunt us with a vengeance.
3.2 What are the basic types of firewalls?
Conceptually, there are three types of firewalls:
Network layer
Application layer
Hybrids
They are not as different as you might think, and latest technologies are blurring the distinction to the point where it's no longer clear if either one is ``better'' or ``worse.'' As always, you need to be careful to pick the type that meets your needs.
Which is which depends on what mechanisms the firewall uses to pass traffic from one security zone to another. The International Standards Organization (ISO) Open Systems Interconnect (OSI) model for networking defines seven layers, where each layer provides services that ``higher-level'' layers depend on. In order from the bottom, these layers are physical, data link, network, transport, session, presentation, application.
The important thing to recognize is that the lower-level the forwarding mechanism, the less examination the firewall can perform. Generally speaking, lower-level firewalls are faster, but are easier to fool into doing the wrong thing.
These days, most firewalls fall into the ``hybrid'' category, which do network filtering as well as some amount of application inspection. The amount changes depending on the vendor, product, protocol and version, so some level of digging and/or testing is often necessary.
3.2.1 Network layer firewalls
These generally make their decisions based on the source, destination addresses and ports (see Appendix 6 for a more detailed discussion of ports) in individual IP packets. A simple router is the ``traditional'' network layer firewall, since it is not able to make particularly sophisticated decisions about what a packet is actually talking to or where it actually came from. Modern network layer firewalls have become increasingly sophisticated, and now maintain internal information about the state of connections passing through them, the contents of some of the data streams, and so on. One thing that's an important distinction about many network layer firewalls is that they route traffic directly though them, so to use one you either need to have a validly assigned IP address block or to use a ``private internet'' address block [5]. Network layer firewalls tend to be very fast and tend to be very transparent to users.
...
- طرح و اجرای موضوعات
3.1- بعضی تصمیمات اساسی طراحی در یک firewall چه چیزهایی هستند ؟
تعدادی موضوعات طراحی اساسی وجود دارند که باید توسط یک شخص خوش اقبال که مسئولیت او طراحی ، تعیین و اجرا یا نظارت بر نصب یک firewall است ، تعیین شوند .
اولین و مهمترین تصمیم سیاست اینکه چگونه شرکت یا سازمان شما می خواهد سیستم را اعمال کند ، است ک آیا firewall سرجای خود قرار دارد برای رد کردن تمام خدمات به جز آن هایی که برای کار اتصال به شبکه ضروری هستند ، یا اینکه آیا firewall برای تهیه یک متد ارزیابی شده کنترل شده ی دستیابی مرتب در یک حالت غیر تعدید آمیز در جای خود قرار گرفته ؟ در جایی از شکاکیت بین این موقعیت ها وجود دارند نقطه بعدی از firewall شما ممکن است بیشتر نتیجه ی یک تصمیم سیاسی باشد تا اجتماعی
دومی بدین قرار است : چه سطحی از مانیتورینگ (کنترل) افزونگی(زیادی) و کنترل را شما می خواهید ؟
با تثبیت کردن سطح ریسک قابل قبول (یعنی ، چقدرشما محتاط هستید ) از طریق حل مورد اول شما می توانید یک فهرست بازبینی از آنچه که باید مونیتور شود ، مجاز شود و رد شود تشکیل دهید . به عبارت دیگر شما شروع می کنید با فهمیدن (دانستن) اهداف کلی تان و سپس یک تحلیل حتمی را ترکیب می کنید با یک سنجش و لوازم (شرایط یا مقتضیات) تقریبا همیشه متناقض را در یک لیست نشست و رفت تفکیک کنید که مشخص کند چه کاری می خواهید انجام دهید . (چه طرحی را می خواهید اجراکنید.)
سومین مورد مالی است . ما نمی توانیم آن را در اینجا ذکر کنیم مگر با عبارت مهم و دو پهلو ، اما مهم است که سعی کرد هر گونه راه حل پیشنهاد شده را با توجه به قیمتی که برای خریدن یا برای اجرا دارد تعیین کرد . برای مثال یک محصول کامل firewall ممکن است حداکثر 100000 $ حداقل رایگان باشد . حق داشتن محصول رایگان شاید نیاز به هزینه ای برای پیکر بندی روی یک cisco یا مشابه آن نداشته باشد ، اما نیاز به زمانی پرکار و چند فنجان قهوه دارد ! اجرای یک firewall سطح بالا نیاز به هزینه ی زیادی دارد ، شاید برابر با 30000 $ به اندازه ی حقوق و مزایای کارمندی هزینه های جاری مدیریت سیستم ها هم قابل توجه است .
ساختن یک نوع خانگی خوب است ، اما مهم این است که آن را طوری ساخت به توجه مداوم (و هزینه بردار ) نداشته باشد . به عبارت دیگر مهم است که firewall ها را نباید فقط با نظر به اینکه چقدر قیمت دارند سنجید بلکه باید هزینه های متوالی را هم در نظر داشت . از جنبه ی تکنیکی دو تصمیم باید گرفته شوند ،بر مبنای آن حقیقت که برای تمام اهداف عملی و مفید ما درباره آن صحبت می کنیم یک سرویس فرستادن ترافیک ثابت ، بین فرستنده ی (routers ، تعیین مسیر کننده ی) تهیه کننده ی شبکه و شبکه داخلی شما قرار دارد .
...