CompTIA Network+ Preparation · lesson 18 of 30 · 25 min
Firewalls
A firewall controls traffic between network zones based on rules. It is the primary perimeter security device.
Packet-filtering firewall — inspects individual packets based on source/destination IP, port, and protocol. Stateless — does not track connection state. Fast but limited.
Stateful firewall — tracks the state of active connections. Allows return traffic for established connections automatically. Most common firewall type.
Application-layer firewall (proxy/NGFW) — inspects traffic at Layer 7. Can identify applications regardless of port. Next-Generation Firewalls (NGFW) add IPS, SSL inspection, and application awareness.
WAF (Web Application Firewall) — protects web applications from attacks like SQL injection and XSS. Operates at Layer 7, specifically for HTTP/HTTPS traffic.
IDS and IPS
IDS (Intrusion Detection System) — monitors traffic and alerts on suspicious activity. Passive — does not block traffic. Out-of-band (receives a copy of traffic via SPAN port).
IPS (Intrusion Prevention System) — monitors traffic and actively blocks threats. Inline — sits in the traffic path. Can drop packets, reset connections, or block IPs.
Detection methods:
Signature-based — matches traffic against known attack patterns. Fast and accurate for known threats. Cannot detect zero-day attacks.
Anomaly-based (behavioral) — establishes a baseline of normal traffic and alerts on deviations. Can detect unknown threats but generates more false positives.
HIDS vs NIDS: Host-based IDS runs on individual systems (monitors logs, file changes). Network-based IDS monitors network traffic.
Key Distinction
IDS = detect and alert (passive, out-of-band). IPS = detect and block (active, inline). An IPS that fails open passes all traffic; one that fails closed blocks all traffic.
Other Security Devices
UTM (Unified Threat Management) — all-in-one security appliance combining firewall, IPS, antivirus, VPN, and content filtering. Common in SMBs.
Proxy server — intermediary between clients and the internet. Forward proxy: client-side (caches content, filters URLs). Reverse proxy: server-side (load balancing, SSL termination, hides server IPs).
Honeypot — decoy system designed to attract attackers. Detects intrusion attempts and gathers intelligence. Should be isolated from production systems.
Jump server (bastion host) — hardened server used as a single entry point for administrative access to internal systems. All admin traffic goes through the jump server — auditable and controlled.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Network+ — Network Security Devices
What is the key difference between IDS and IPS?
- IDS is hardware; IPS is software
- IDS detects and alerts (passive); IPS detects and blocks (active)
- IDS is inline; IPS is out-of-band
- IDS uses signatures; IPS uses anomaly detection
Answer: IDS detects and alerts (passive); IPS detects and blocks (active)
IDS = passive monitoring, alerts only. IPS = inline, actively blocks threats. IPS is in the traffic path; IDS receives a copy.
A stateful firewall differs from a packet filter by:
- Operating at Layer 7
- Tracking the state of active connections
- Blocking all inbound traffic
- Requiring a proxy
- Answer: Tracking the state of active connections
Stateful firewalls track connection state — they automatically allow return traffic for established connections without explicit rules. Signature-based IDS/IPS cannot detect:
- Known malware
- Port scans
- Zero-day attacks
- SQL injection
- Answer: Zero-day attacks
Signature-based detection requires a known pattern. Zero-day attacks are unknown — no signature exists yet. Anomaly-based detection can catch them. A WAF specifically protects against:
- Network-layer DDoS
- SQL injection and XSS targeting web applications
- Wireless attacks
- Physical intrusion
- Answer: SQL injection and XSS targeting web applications
WAF = Web Application Firewall. Operates at Layer 7 for HTTP/HTTPS — protects against web-specific attacks like SQLi, XSS, CSRF. A honeypot is used to:
- Cache web content
- Attract attackers to detect intrusions and gather intelligence
- Filter spam email
- Terminate SSL connections
- Answer: Attract attackers to detect intrusions and gather intelligence
Honeypots are decoy systems — they look valuable to attackers but are isolated. Any interaction is suspicious and logged. A reverse proxy is placed:
- Between clients and the internet
- Between the internet and backend servers
- Inside the client browser
- On the DNS server
- Answer: Between the internet and backend servers
Reverse proxy sits in front of servers — provides load balancing, SSL termination, and hides backend server IPs from clients. A jump server (bastion host) is used for:
- Caching DNS queries
- Controlled administrative access to internal systems
- Wireless authentication
- DHCP relay
- Answer: Controlled administrative access to internal systems
Jump servers are the single hardened entry point for admin access — all administrative sessions go through it, creating an audit trail. UTM devices are most common in:
- Large enterprises with dedicated security teams
- SMBs needing all-in-one security
- ISP core networks
- Data centers only
- Answer: SMBs needing all-in-one security
UTM combines firewall, IPS, AV, VPN, and content filtering in one appliance — cost-effective for SMBs that cannot afford separate devices. Anomaly-based IDS establishes:
- A list of known attack signatures
- A baseline of normal traffic and alerts on deviations
- A firewall rule set
- A VPN tunnel
- Answer: A baseline of normal traffic and alerts on deviations
Anomaly-based detection learns normal behavior and flags deviations. Can detect unknown threats but generates more false positives.
An IPS sits _____ in the network traffic path.
Answer: inline
IPS is inline — all traffic passes through it so it can drop malicious packets. IDS is out-of-band, receiving only a copy of traffic.
Previous lesson: Network documentation: diagrams, IP schema, change management, disaster recovery
Back to CompTIA Network+ Preparation
Next lesson: Backup and recovery: full, incremental, differential; 3-2-1 rule, RTO, RPO