CiscoSecure PIX Firewall Technology

The key to Cisco Secure Firewall technology is the ASA. Like other stateful technologies, ASA stores key information from outgoing packets, which are then used to screen returning packets. As with others, source and destination addresses and port information are stored, but then randomized TCP sequence numbers are generated and, together, are encrypted into a “signature” used to evaluate new packets. These randomized TCP sequence numbers make hacking considerably more difficult than the often-sequential incrimination used by most systems. These random-sequence numbers and encryption create a secure stateful connection system that’s both efficient and fast.

No inbound traffic is allowed unless specifically accepted as part of an existing flow in the state table, or included in a conduit or access list definition. For example, all inbound ICMP packets are blocked unless specifically permitted by the conduit permit icmp command.

Cisco PIX 500 Series Firewalls security appliances are famous for high levels of security, performance, and reliability. These devices provide a solid package of security services, including stateful firewall inspection, standards-based IPSec VPN, intrusion protection, and much more in several platforms to meet the needs of the smallest office to the largest enterprise.

The following material identifies the target audience for each of the platforms with feature and performance indicators gleaned from current Cisco marketing materials.

PIX Firewalls provide high levels of security. They’ve been tested and certified to meet certain levels of quality, reliability, and trustworthiness by the leading security organizations, including TruSecure’s ICSA Firewall and IPSec certification, and the independent Common Criteria Evaluation Assurance’s EAL4 rating. The Common Criteria EAL4 certification requires in-depth analysis of product design and development methodology, backed by extensive testing.

The Common Criteria for Information Technology Security Evaluation (CCITSE) is a set of evaluation criteria agreed to by the United States National Security Agency/National Institute of Standards and Technologies, and equivalent bodies in 13 other countries. The organization’s role is to resolve the technical and conceptual differences in existing standards for the evaluation of security systems and products. Common Criteria version 2.1 recently became an international standard—ISO 15408.

PIX Firewalls support a wide range of security and networking services, including Network Address Translation (NAT), Port Address Translation (PAT), DHCP client and server, AAA (both TACACS+ and RADIUS) integration, content filtering (Java/ActiveX), URL filtering, PPP over Ethernet (PPPoE), and Public-Key Infrastructure X.509. PIX Firewall devices support security services for multimedia applications and protocols, including Voice over IP (VoIP), H.323, SIP, Skinny, and Microsoft NetMeeting to allow organizations to securely implement next-generation converged network technologies.

PIX Firewall devices support Cisco’s familiar command-line interface (CLI) using access methods including Telnet, Secure Shell (SSH), and an out-of-band console port. While not identical to the router CLI, the differences represent no greater challenge than those encountered when working with Cisco switches.

Administrators can choose from a variety of other solutions for remotely configuring, monitoring, and troubleshooting PIX Firewall devices. These solutions range from an integrated, web-based management interface (PIX Device Manager) to centralized, policy-based management tools. The PIX devices support remote monitoring protocols, such as Simple Network Management Protocol (SNMP) and support Syslog logging features.

The PIX Firewall Series supports the Cisco Mobile Office strategy to extend the corporate network by offering high bandwidth and complete access through both wired and wireless solutions. The three components of the Cisco Mobile Office include On The Road, At Home, and At Work. Together, they help to create a network that’s secure, flexible, highly manageable, and scalable, and that increases productivity.

Cisco has introduced a PIX Firewall implementation—the Firewall Services Module (FWSM)—bringing firewall protection services to the Catalyst 6500 family of IP switches that already support intrusion detection and VPNs, along with multilayer LAN, WAN, and MAN switching capabilities. The FWSM is completely VLAN-aware, offers dynamic routing, and is a fully integrated module within the Cisco Catalyst 6500 Series switches.

FWSM is based on Cisco PIX Firewall technology and, therefore, offers the same security and reliability as the PIX security appliances. In addition, the FWSM capitalizes on the strengths of the Catalyst system to create the industry’s highest-performance firewall solution, providing 5GB of throughput per module and scaling to 20GB of bandwidth with multiple modules. The module is based on network processor technology, allowing feature enhancements via software download.