|
|archive-url = https://web.archive.org/web/20160521201820/https://www.paloaltonetworks.com/documentation/glossary/what-is-a-firewall
|url-status = dead
}}</ref> their basic function being to control the flow of data between connected networks. They are either a [[software appliance]] running on general-purpose hardware, a [[Computer appliance#Types of appliances|hardware appliance]] running on special-purpose hardware, or a [[virtual appliance]] running on a virtual host controlled by a [[hypervisor]]. Firewall appliances may also offer non-firewall functionality, such as [[DHCP]]<ref>{{Cite web|title = Firewall as a DHCP Server and Client|url = https://paloaltonetworks.com/documentation/70/pan-os/pan-os/networking/firewall-as-a-dhcp-server-and-client.html|website = Palo Alto Networks|access-date = 2016-02-08}}</ref><ref>{{Cite web|title = DHCP|url = http://www.shorewall.net/dhcp.htm|website = www.shorewall.net|access-date = 2016-02-08}}</ref> or [[VPN]]<ref>{{Cite web|title = What is a VPN Firewall? – Definition from Techopedia|url = https://www.techopedia.com/definition/30753/vpn-firewall|website = Techopedia.com|access-date = 2016-02-08}}</ref> services. Host-based firewalls are deployed directly on the [[Host (network)|host]] itself to control network traffic or other computing resources.<ref>{{cite book | first1=John R. | last1=Vacca | title=Computer and information security handbook | publisher=Elsevier | date=2009 | ___location=Amsterdam | page=355 | isbn=9780080921945}}</ref><ref>{{cite web |url=https://personalfirewall.comodo.com/what-is-firewall.html |title= What is Firewall? |access-date=2015-02-12 |archive-date=2015-02-12 |archive-url=https://web.archive.org/web/20150212104623/https://personalfirewall.comodo.com/what-is-firewall.html |url-status=dead }}</ref> This can be a [[daemon (computing)|daemon]] or [[Windows service|service]] as a part of the [[operating system]] or an [[endpoint security|agent application]] for protection.
[[File:Firewall.png|thumb|left|An illustration of a network-based firewall within a network]]
With this setup, only users who authenticate and are identified as members of "Students" are denied to access [[social media]] servers. All other traffic, starting from LAN interfaces, will be allowed.
== Most common firewall log types ==
'''Traffic Logs:'''
*'''Description:''' Traffic logs record comprehensive details about data traversing the network. This includes source and destination IP addresses, port numbers, protocols used, and the action taken by the firewall (e.g., allow, drop, or reject).
*'''Significance:''' Essential for network administrators to analyze and understand the patterns of communication between devices, aiding in troubleshooting and optimizing network performance.
'''Threat Prevention Logs:'''
*'''Description:''' Logs specifically designed to capture information related to security threats. This encompasses alerts from intrusion prevention systems (IPS), antivirus events, anti-bot detections, and other threat-related data.
*'''Significance:''' Vital for identifying and responding to potential security breaches, helping security teams stay proactive in safeguarding the network.
'''Audit Logs:'''
*'''Description:''' Logs that record administrative actions and changes made to the firewall configuration. These logs are critical for tracking changes made by administrators for security and compliance purposes.
*'''Significance:''' Supports auditing and compliance efforts by providing a detailed history of administrative activities, aiding in investigations and ensuring adherence to security policies.
'''Event Logs:'''
*'''Description:''' General event logs that capture a wide range of events occurring on the firewall, helping administrators monitor and troubleshoot issues.
*'''Significance:''' Provides a holistic view of firewall activities, facilitating the identification and resolution of any anomalies or performance issues within the network infrastructure.
'''Session Logs:'''
*'''Description:''' Logs that provide information about established network sessions, including session start and end times, data transfer rates, and associated user or device information.
*'''Significance:''' Useful for monitoring network sessions in real-time, identifying abnormal activities, and optimizing network performance.
'''DDoS Mitigation Logs:'''
*'''Description:''' Logs that record events related to Distributed Denial of Service (DDoS) attacks, including mitigation actions taken by the firewall to protect the network.
*'''Significance:''' Critical for identifying and mitigating DDoS attacks promptly, safeguarding network resources and ensuring uninterrupted service availability.
'''Geo-___location Logs:'''
*'''Description:''' Logs that capture information about the geographic locations of network connections. This can be useful for monitoring and controlling access based on geographical regions.
*'''Significance:''' Aids in enhancing security by detecting and preventing suspicious activities originating from specific geographic locations, contributing to a more robust defense against potential threats.
'''URL Filtering Logs:'''
*'''Description:''' Records data related to web traffic and URL filtering. This includes details about blocked and allowed URLs, as well as categories of websites accessed by users.
*'''Significance:''' Enables organizations to manage internet access, enforce acceptable use policies, and enhance overall network security by monitoring and controlling web activity.
'''User Activity Logs:'''
*'''Description:''' Logs that capture user-specific information, such as authentication events, user login/logout details, and user-specific traffic patterns.
*'''Significance:''' Aids in tracking user behavior, ensuring accountability, and providing insights into potential security incidents involving specific users.
'''VPN Logs:'''
*'''Description:''' Information related to Virtual Private Network (VPN) connections, including events like connection and disconnection, tunnel information, and VPN-specific errors.
*'''Significance:''' Crucial for monitoring the integrity and performance of VPN connections, ensuring secure communication between remote users and the corporate network.
'''System Logs:'''
*'''Description:''' Logs that provide information about the overall health, status, and configuration changes of the firewall system. This may include logs related to high availability (HA), software updates, and other system-level events.
*'''Significance:''' Essential for maintaining the firewall infrastructure, diagnosing issues, and ensuring the system operates optimally.
'''Compliance Logs:'''
*'''Description:''' Logs specifically focused on recording events relevant to regulatory compliance requirements. This may include activities ensuring compliance with industry standards or legal mandates.
*'''Significance:''' Essential for organizations subject to specific regulations, helping to demonstrate adherence to compliance standards and facilitating audit processes.
== Configuration ==
== External links ==
* [http://docstore.mik.ua/univercd/cc/td/doc/product/iaabu/centri4/user/scf4ch3.htm Evolution of the Firewall Industry] – discusses different architectures, how packets are processed and provides a timeline of the evolution.
* [http://www.cs.unm.edu/~treport/tr/02-12/firewall.pdf A History and Survey of Network Firewalls] {{Webarchive|url=https://web.archive.org/web/20170830035901/http://www.cs.unm.edu/~treport/tr/02-12/firewall.pdf |date=2017-08-30 }} – provides an overview of firewalls at various ISO levels, with references to original papers where early firewall work was reported.
{{Computer security}}
| 