Technology Sharing

한어Русский языкEnglishFrançaisIndonesianSanskrit日本語DeutschPortuguêsΕλληνικάespañolItalianoSuomalainenLatina

There are many different deployment modes for firewalls, each with its own specific application scenarios and advantages and disadvantages. The following are the main deployment modes for firewalls:

1. Classification by working mode

1. Routing Mode
   • definition: When the firewall is located between the internal network and the external network, it is necessary to configure the interfaces connecting the firewall to the internal network, external network, and DMZ (demilitarized zone) into IP addresses of different network segments and re-plan the original network topology. At this time, the firewall is equivalent to a router.
   • Features：
     • The Trust zone interface of the firewall is connected to the company's internal network, and the Untrust zone interface is connected to the external network, which are located in two different subnets.
     • It can complete functions such as ACL (Access Control List) packet filtering, ASPF (Application Layer Stateful Inspection Firewall) dynamic filtering, and NAT (Network Address Translation) conversion.
     • The network topology needs to be modified, internal network users need to change the gateway, routers need to change the routing configuration, etc., which is relatively complicated.
   • Applicable scene: Mostly used for egress deployment configuration, such as NAT, routing, and port mapping.
2. Transparent Mode
   • definition: In transparent mode, the firewall is inserted into the network like a bridge, without modifying any existing configuration.
   • Features：
     • The firewall is connected to the outside world through the second layer (the interface has no IP address).
     • The port mapping function and NAT function cannot be used.
     • It is often used in series in the network to provide boundary protection for two different security domains, and it can also avoid the trouble caused by changing the topology.
   • Applicable scene: Commonly used in scenarios where the network structure needs to remain unchanged but security protection needs to be increased.
3. Blending Mode
   • definition: The firewall has interfaces that work in both routing mode and transparent mode (some interfaces have IP addresses, and some interfaces do not have IP addresses).
   • Features：
     • The internal network and the external network must be in the same subnet.
     • It is mainly used for dual-machine backup in transparent mode. In this case, the interface that starts the VRRP (Virtual Router Redundancy Protocol) function needs to be configured with an IP address, while other interfaces do not need to be configured with an IP address.
   • Applicable scene: Less common, mainly used in specific high availability requirements scenarios.

     

2. Classification by network structure

1. Single-layer firewall mode
   • definition: A firewall is only set up at one entrance of the network. All data traffic needs to pass through this firewall and be managed and filtered by it.
   • Features：
     • Simple to deploy and easy to manage.
     • The protection capability is relatively weak and can be easily bypassed by attackers.
   • Applicable scene: Suitable for small networks or scenarios with low security requirements.
2. Double-layer firewall mode
   • definition: Two firewalls are set up at the entrance of the network, the inside and outside are the DMZ area and the internal network respectively.
   • Features：
     • It has strong protection capability and can effectively prevent attacks from different directions.
     • Deployment and management are relatively complex.
   • Applicable scene: Suitable for medium and large networks or scenarios with high security requirements.
3. Layer 3 firewall mode
   • definition: Three firewalls are set up at the entrance of the network, namely the internal network, DMZ area and external network. Each firewall will detect and manage data traffic.
   • Features：
     • The protection capability is very strong and can effectively prevent attacks from different directions.
     • Deployment and management are relatively complex and require comprehensive planning and design of network topology and security policies.
   • Applicable scene: Suitable for large enterprise networks or scenarios with extremely high security requirements.
4. Centralized firewall mode
   • definition: Centralize the management and configuration of multiple firewalls on a central console.
   • Features：
     • Management and configuration are relatively convenient, and all firewalls can be managed and controlled in a unified manner.
     • Relatively weak protection because all traffic passes through a single point of control.
   • Applicable scene: Applicable to scenarios where unified management and control of multiple firewalls are required.
5. Distributed Firewall Mode
   • definition: Multiple firewalls are deployed on different network nodes, and each firewall has independent management and control capabilities.
   • Features：
     • The protection capability is very strong, and different network nodes can be protected by firewalls in different locations.
     • Management and configuration are complex.
   • Applicable scene: Suitable for large, complex or distributed network structures.

In summary, there are many different deployment modes for firewalls. It is very important to choose the appropriate deployment mode based on factors such as specific network architecture, security requirements, and management requirements.