Front cover - IBM Redbooks

124 Lotus Security Handbook
alarming, but should never be relied on as a primary and dependable means of
providing security to a business.
Routers
A simple description of what a router does is forward data packets from one
network to another. This description conjures up images such as a ferry for
passengers between two land masses. However, routers today have become
extremely diverse in their range of functions and capabilities. So now the image
is more sophisticated, like perhaps that of a major airline’s hub airport for
passengers and cargo, with transfers to trains, buses, trucks, cars, and so forth.
Routers are always the first line of defense for network traffic coming to your
organization from the Internet. They are also the last point of control for traffic
from your organization bound for the Internet. The router under your control that
immediately connects to your Internet service provider (ISP) is often called your
border router. In the times before ISPs, the telephony world called this the
demarcation point. It is where the service provider’s control (and responsibility)
ends and your organization’s responsibility and control begins. Note that many
large organizations have more than one Internet connection and potentially more
than one border router.
As we discuss later, a router is typically performing at least basic packet filtering
as a form of access control. Think of this access control as a traffic cop, deciding
who can turn down different roads and who can’t. In this case we will identify the
router as a type of firewall. Note that not all network routers can, nor should,
perform filtering; just keep in mind that they can. Again, we are saying when we
employ any filters on a router, it becomes a very basic type of firewall.
Switches and hubs
Switches and hubs provide a virtual ethernet bus, and for the most part have
completely replaced ethernet using a coaxial cable physical bus architecture.
The days of having to drill taps into “thick ethernet” coax are (thankfully) behind
us. As previously mentioned, a security benefit of switch technology is the fact
that all packets on the segment are not transmitted to all devices connected to
the switch. This greatly reduces the packets that can be “seen” by a sniffer
connected to one port on the switch. The exception to this is broadcast packets
that some protocols use where the packets get transmitted out all the switch
ports.
NAT
Originally, Network Address Translation (NAT) was proposed in IETF RFC-1918
as a short-term solution to the problem of IP address depletion. In order to be
assured of any-to-any communication on the Internet, all IP addresses have to
be officially assigned by the Internet Assigned Numbers Authority (IANA). This is