ccna 4 chapter 4

ccna 4 chapter 4.Traffic originating from the private network is detected on its way to the public or DMZ network and is allowed to be sent with no or little restriction; returning from the DMZ or public network, detected traffic going to the private network is allowed in. Traffic originating from the DMZ network is typically blocked on its way to the private network.Traffic originating from the DMZ network is selectively allowed when going to the public network based on the demand for the service.Traffic originating from the public network is selectively allowed and detected when going to the DMZ. This type of traffic is typically e-mail,DNS, HTTP or TTTPS traffic. Returning from the DMZ, traffic to the public network is dynamically allowed. Traffic originating from the public network is blocked when going to the private network.4.2.4.2 Layered DefenseIn a layered defense scenario, the firewall provides perimeter security for the entire network and the internal network segment of the core. For example, a network security practitioner can use a protective wall to isolate the human resources network or financial network within a company from the rest of that company's network or segments.Layered defense systems use different types of firewalls at different levels to enhance the security of an organization. For example, traffic from untrusted networks first encounters packet filters on external routers; it then reaches a shielded firewall or bastion host system that can apply more rules to the traffic and can discard suspicious packets. The bastion host is usually a hardened computer located in the DMZ; the traffic now reaches the internal shield router. Traffic can only reach the internal destination host if it successfully passes all filters between the external router and the internal network. This type of DMZ setup is called a blocked subnet configuration.A common misconception is that a layered firewall topology is all that is needed to secure the internal network. This misconception is likely tobe validated and encouraged by the growing firewall business. In reality, there are many factors for network administrators to consider when building a complete defense in depth. A large number of intrusions come from hosts on the internal network. For example, firewalls are often helpless against viruses downloaded via e-mail. Firewalls cannot stop rogue tuned demodulators from being installed. Firewalls are not a substitute for backup and disaster recovery mechanisms, which can be useful in the event of an attack or hardware failure. Defense in depth should also include offsite