لطفا منتظر باشید ...
Chapter 10: ISA 2004 Stateful Inspection and Application Layer Filtering
Introduction
The ISA firewall is able to perform both stateful filtering and stateful application layer inspection. The ISA firewall's stateful filtering feature set makes the ISA firewall a network layer stateful firewall in the same class as any hardware firewall that performs stateful filtering at the network and transport layers. Stateful filtering is often referred to as stateful packet inspection, which is a bit of a misnomer because packets are layer 3 entities and in order to assess connection state, layer 4 information must be assessed.
However, in contrast to traditional packet filter based stateful hardware firewalls, the ISA firewall is able to perform stateful application layer inspection. Stateful application layer inspection enables the ISA firewall to fully inspect the communication streams passed by the ISA firewall from one Network to another. In contrast to stateful filtering where only the network and transport layer information is filtered, true stateful inspection requires that the firewall be able to analyze and make decisions on all layers of the communication, including the most important layer, the application layer.
In this chapter we will discuss the following:
Application Filter
Web Filters
The Web filters perform stateful application layer inspection on communications handled by the ISA firewall's Web Proxy components. The Web Proxy handles connections for HTTP, HTTPS (SSL), and HTTP tunneled FTP connections. The Web filters take apart the HTTP communications and expose them to the ISA firewall's application layer inspection mechanisms, examples of which include the HTTP Security filter and the OWA forms-based authentication filter.
The Application filters are responsible for performing stateful application layer inspection on non-HTTP protocols, such as SMTP, POP3, and DNS. These application layer filters also take apart the communication and expose them to deep stateful inspection at the ISA firewall.
Web and Application filters can perform two duties:
Protocol access
Protocol security
Protocol access allows access to protocols that require secondary connections. Complex protocols may require more than one connection, either inbound or outbound through the ISA firewall. SecureNAT clients require these filters to use complex protocols because the SecureNAT client does not have the power of the Firewall client. In contrast to the Firewall client that can work together with the ISA firewall to negotiate complex protocols, the SecureNAT client is a simple NAT client of the ISA firewall and requires the aid of application filters to connect using these complex protocols (such as FTP or MMS).
Protocol security protects the connections moving through the ISA firewall. Protocol security filters such as the SMTP and DNS filters inspect the communications that apply
to those filters and block connections that are deemed outside of secure parameters. Some of these filters block connections that may represent buffer overflows (such as the DNS and SMTP filters), and some of them perform much deeper inspection and block connections or content based on policy (such as the SMTP Message Screener).
