Workshop

Q My vendor says that its firewall isn’t a packet-filtering router or a proxy server. What’s up with
that?
A I love vendors. They’re so funny sometimes. Here’s the deal: Packet-filtering routers got a really,
really bad rap a couple of years ago when someone figured out how to fake them out. They received a lot
of bad press. Therefore, advanced firewalls aren’t really considered to be packet-filtering routers
anymore—even though they still route packets, they still deal with packets on a network level, and they
still filter. Also, they’re not particularly the ones with SMLI (which make decisions on the application
level). Still, if it walks like a duck…
Q Can’t my proxy server be compromised by all the bugs out there?
A Anything’s possible. Whether you have a proxy server or a firewall, stay in touch with your vendor
and be sure to get security patches as they become available. In general, however, your proxy server
should not be running other programs besides the proxy programs—unless you’re a security expert and
can warrant that these other programs won’t put the server at risk.
Quiz
1. What’s the difference between a proxy server and a packet-filtering router?
A. Proxy servers filter on the network level, whereas routers filter on the application level.
B. Proxy servers filter on the application level, whereas routers filter on the network level.
C. Routers are security risks with improper configurations.
D. Proxy servers are security risks with improper configurations.
2. True or false? A proxy server is not considered “network glue.” Instead, it’s considered “just
another server” (albeit a multihomed server).
3. A packet-filtering router and a proxy server are both ________.
A. users of Stateful Multi-Level Inspection
B. multihomed
C. security loopholes
D. socket rockets
4. TCP is ______________, and UDP is ___________.
A. a pain to configure; wonderful
B. problematic with government installations; okay with corporations
C. easy; hard
D. connection oriented; connectionless
5. A proxy server can be overburdened by which of the following?
A. Users asking it to proxy local LAN connections
B. Users asking it to link to infrastructure valence
C. Too much T1 traffic
D. Too much searching on a Web site
6. You can use normal DNS troubleshooting tools from within your network if which of the