collision course

Newbie

Posts: 26

« on: June 12, 2003, 04:41:54 AM »

given that a netscreen idp can (just about) be used as a firewall
(since it can _also_ block on protocols and src / dest)

and given the latest version of firewall-1 (ng ai [aka fp4]) can now
dig into the protocols (eg verifying that ssh is using protocol 2 to
the endpoint, also eg looking at netbios requests \\server\share)

...

they may be on a collsion course.

firewalls moving up the stack, intrusion prevention moving down the
stack.

thoughts anyone?

--
me


	Logged

mirom

Jr. Member

Posts: 63

collision course

« Reply #1 on: June 14, 2003, 03:28:28 PM »

there will be some news from NS about this too in near future. Things are getting interesting


	Logged

dkillion

Full Member

Posts: 113

collision course

« Reply #2 on: September 05, 2003, 12:46:09 PM »

Presently the IDP really isn't appropriate for managing your layer 3/4 security (Specifing From/To IP's and port permissions). It's also a 'fail-open' system which is inappropriate for a firewall.

But Mirom says, things are changing - technology moves forward, things get interesting...

-Dave


	Logged

Dave Killion
NetScreen Certified Associate (NSCA)

Anonymous

Guest

collision course

« Reply #3 on: September 05, 2003, 02:05:14 PM »


	Logged

mirom

Jr. Member

Posts: 63

collision course

« Reply #4 on: September 05, 2003, 02:06:48 PM »

Dave is right


	Logged

arc

Newbie

Posts: 29

collision course

« Reply #5 on: September 16, 2003, 10:19:58 PM »

Actually, I was informed that the IDP is a "fail closed" device when placed in-line, but that this was configurable... just as it is always an option to just place the IDP unit in "sniffer" mode off of a mirror port.

The original point is a good one, though, that I think all the security vendors are forseeing. I think that is what is driving the marketing lingo to transition to the phrase "deep packet inspection". As you say firewalls are needing to understand application layer protocols in order to deal properly with the dynamic port allocation schemes involved in things like SIP and H.323, while IDS/IPS products are realizing that they need to come inline and drop actual traffic like a firewall to be truly useful to customers.

The problem, though, is that IPS products still have a way to go when it comes to "single-point-of-failure" concerns like: 1) reliability, 2) fail-over, 3) accuracy, 4) performance (bandwidth/latency/session-ramping, etc.) Meanwhile, firewalls have a long way to go to be able to really deal effectively with a wide variety of application protocols. NetScreen and the others seem aware that they have their work (and opportunity) in front of them though... and I think that NetScreen is one of the ones really beginning to grasp the full extent of it.


	Logged

gr33ndata

Sr. Member

Posts: 366

collision course

« Reply #6 on: September 19, 2003, 12:08:16 AM »

I think that in the near future more companies will be moving toward the idea of "Security Gates" or whatever they may call them, where they will be a replacement for firewalls, IDSs and antiviruses, and put them all in one single appliance.


	Logged

Gr33nData, or you may call me NetScream
JNCIS-FWV, and JNCIA-IDP
http://gr33ndata.blogspot.com/

Newbie

Posts: 26

collision course

« Reply #7 on: October 21, 2003, 02:47:59 PM »

the idp can fail open or closed. it's just that you have to buy an extra bypass unit (one per network segment) to achieve fail open. (the bypass units are just 5gt boxes with a different version of screenos).

also the idp's can go fault-tolerant/ha

performance may be an issue depending on what type/volume of traffic is crossing the wire.


	Logged

dkillion

Full Member

Posts: 113

collision course

« Reply #8 on: October 30, 2003, 11:00:20 AM »

What I meant by 'fail open' perhaps was bad wording = basically if the packet isn't tripped by any policy, the packet sails through. At this point, it's not very easy to say "If it matches 'ATTACK-X' then let it through, otherwise, drop" - there aren't any "Happy Sigs". The IDP only looks for bad, not for good.

Coming in 3.0 will be the power to negate a sig, including user-defineable sigs. So one could make a sig on their own that said "DNS Request = mydomain.com", then negate it - now only "Approved" DNS requests would be permitted. It's a lot easier to enumerate what's allowed, than try to imagine all the things that aren't allowed. This a poor example, but you get the idea.


	Logged

Dave Killion
NetScreen Certified Associate (NSCA)

Hugodrax

Newbie

Posts: 1

Layer 7 firewalls

« Reply #9 on: October 31, 2003, 11:40:14 PM »

Looks like the collision course is going fullspeed. It was only a matter of times. Firewall technology has been long in the tooth for sometimes now and IDS although a useful tool is not really enough. I would say nextyear most major vendors will provide layer 7 firewall rules support.


	Logged

Pages: [1]

JuniperForum.com > Security > IDP > Topic: collision course

« previous next »

Latest Knowledgebase Articles

Navigation

Donate

Tools

Recent

Stats

Members

Stats

Users Online