Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

Network Devices 49
Firewall Features
As firewalls have evolved, additional feature sets have been developed for these
devices such as:
■
■
■
■
Encryption mechanisms.
Caching for Web services.
Virtual private network functionality.
Content filtering from applets, scripts, and components.
Demilitiarized Zone
In computer security, the demilitiarized zone (DMZ) is a neutral network segment
where systems accessible to the public Internet are housed, which offers some
basic levels of protection against attacks. The creation of these DMZ segments is
usually done in one of two ways:
■ Layered DMZ implementation The systems are placed between two firewall
devices with different rule sets, which allows systems on the Internet to
connect to the offered services on the DMZ systems, but prevents them from
connecting to the computers on the internal segments of the organization’s
network.
■ Multiple interface firewall implementation This method involves adding a
third interface to the firewall and placing the DMZ systems on that network
segment.
The role of the firewall in each of these scenarios is to manage the traffic between
the network segments. The basic idea is that other systems on the Internet
are allowed to access only the services of the DMZ systems that have been
made public. In this way, systems are exposed only to attacks against the services
that they offer and not to underlying processes that may be running on
them.
Access Control Lists
Access control lists (ACLs) are used to control access to specific resources on a
device or network. An ACL resides on a computer or network device and is a
table with information on which specific rights have been granted. The operating
system or network device uses the ACL to determine whether an allowed or denied
privilege is granted.
Proxy Server (Caching Appliances)
A proxy server is a server that performs a function on behalf of another system,
typically browser-based requests to and from the Internet. The users perform
actions as they normally would but will submit the request to the proxy server.
The proxy server will then transmit the request and receive the results often times
caching these results for later use.