securely. Because filters pass traffic directly from an untrusted network, they are not as secure as oth
er gateways.
Circuit-level gateways
operate at the session level and require modified clients to communicate directly with the gateway, which appears to the outside host as the session originator. Typically these gateways use a state table listing valid connections, with subsequent connections granted or denied by comparing the request with state table data. Circuit gateways are less useful in environments where users need several types of Internet service or where in-bound services must be provided.
Application-level gateways
(aka proxies) operate at the application level, negotiating each client/server connection made between a host on the trusted network and a host outside. Like the circuit gateway, they never directly link trusted and untrusted networks. Hosts inside the trusted network point their clients to the application gateway, which accepts client requests (e.g., HTTP, Telnet, or FTP) and relays them to an external destination host as if th
e firewall were the requesting client. The firewall accepts replies from outside and resends them to the internal client. Operating at the application layer enables features such as user authentication and protocol-specific filters like ActiveX blocks.
Stateful inspection
uses a table of rules in which the firewall administrator defines parameters for the different services on your network. The firewall then tests the "state" of TCP traffic as it passes through the firewall by checking it against the state table. Although stateful inspection detects many known attacks, with many more added as they become known, if the state table becomes corrupt the network has a chance of being exposed.
Firewall Technology Trade-Offs
