Security profiles are crucial components of modern firewalls that help secure your network by inspecting traffic beyond basic access control. At the edge of your network, these profiles can detect malicious activities, block unwanted content, and scan files for threats.
Overview
A firewall at the network edge decides who can communicate with what (addresses/ports). Security profiles then inspect the contents of allowed conversations to ensure they are safe. These profiles are implemented differently depending on the firewall software but share similar concepts.
Intrusion Prevention System (IPS)
The IPS profile is designed to detect and block known malicious activities in real time. It works by matching traffic against a database of known exploits or attack tools, then dropping any matches immediately. IDS (Intrusion Detection System) operates similarly but only alerts without taking action.
Deployment Considerations:
- CPU Cost: Enabling IPS can significantly impact the firewall's performance.
- False Positives: Start in monitor mode to watch for a week before enforcing rules.
- Tuning: Adjust signatures based on your specific network needs (e.g., no point matching IIS exploits if you only have Linux servers).
Web Filtering
Web filtering profiles allow or block HTTP(S) destinations by category, such as malware, phishing, gambling, and ads. Modern web filtering works with HTTPS traffic using SNI (Server Name Indication) to categorize URLs without decrypting the content. For more granular control over content, SSL inspection is required.
Deployment Considerations:
- Category Filtering: Use vendor-maintained URL databases or custom lists.
- SSL Inspection: Needed for deep content-level filtering but can impact performance and require additional setup.
Antivirus/Antimalware
Antivirus/antimalware profiles scan files crossing the firewall, such as downloads or email attachments, against a database of known malware signatures. Scanning methods include flow-based (quick, sample-based) and proxy-based (thorough, buffers entire file).
Deployment Considerations:
- Edge vs Endpoint AV: Edge antivirus is supplementary to endpoint antivirus; encrypted or split transfers can bypass it.
- Performance Impact: Edge scanning can reduce network throughput.
Application Control
Application control profiles identify applications based on traffic patterns rather than just ports. This allows you to enforce policies like "no BitTorrent" by intent, not by port number.
Deployment Considerations:
- Intent-Based Policies: Focus on the desired outcome (e.g., no file sharing) rather than specific ports.
- Complexity: Requires understanding of common application traffic patterns.
DNS Filtering
DNS filtering profiles block malicious or unwanted domains at the time they are resolved. This is one of the most CPU-efficient ways to protect your network, as it prevents access before any data transfer occurs.
Deployment Considerations:
- Self-Hosting Options: Tools like Pi-hole and AdGuard can be self-hosted for this purpose.
- Layered Defense: Combining DNS filtering with IPS, web filtering, and endpoint antivirus provides comprehensive protection.
Deployment Truths
- CPU Impact: Enabling all profiles can reduce network performance. Size the firewall appropriately based on inspected throughput needs.
- Subscription Updates: Regularly update profile subscriptions to stay effective against new threats.
- Log First, Enforce Second: Start with logging and monitoring before enforcing policies.
- Layered Defense: Combining multiple security measures provides better overall protection.
By understanding these profiles and their deployment considerations, you can effectively secure your network at the edge.