Page 146 / 234 Scroll up to view Page 141 - 145
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
B-10
Networks, Routing, and Firewall Basics
May 2004, 202-10030-02
The FVL328 Firewall also functions as a DHCP client when connecting to the ISP. The firewall
can automatically obtain an IP address, subnet mask, DNS server addresses, and a gateway address
if the ISP provides this information by DHCP.
Internet Security and Firewalls
When your LAN connects to the Internet through a router, an opportunity is created for outsiders
to access or disrupt your network. A NAT router provides some protection because by the very
nature of the Network Address Translation (NAT) process, the network behind the NAT router is
shielded from access by outsiders on the Internet. However, there are methods by which a
determined hacker can possibly obtain information about your network or at the least can disrupt
your Internet access. A greater degree of protection is provided by a firewall router.
What is a Firewall?
A firewall is a device that protects one network from another, while allowing communication
between the two. A firewall incorporates the functions of the NAT router, while adding features for
dealing with a hacker intrusion or attack. Several known types of intrusion or attack can be
recognized when they occur. When an incident is detected, the firewall can log details of the
attempt, and can optionally send e-mail to an administrator notifying them of the incident. Using
information from the log, the administrator can take action with the ISP of the hacker. In some
types of intrusions, the firewall can fend off the hacker by discarding all further packets from the
hacker’s IP address for a period of time.
Stateful Packet Inspection
Unlike simple Internet sharing routers, a firewall uses a process called stateful packet inspection to
ensure secure firewall filtering to protect your network from attacks and intrusions. Since
user-level applications such as FTP and Web browsers can create complex patterns of network
traffic, it is necessary for the firewall to analyze groups of network connection “states.” Using
stateful packet inspection, an incoming packet is intercepted at the network layer and then
analyzed for state-related information associated with all network connections. A central cache
within the firewall keeps track of the state information associated with all network connections.
All traffic passing through the firewall is analyzed against the state of these connections in order to
determine whether or not it will be allowed to pass through or be rejected.
Page 147 / 234
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
Networks, Routing, and Firewall Basics
B-11
May 2004, 202-10030-02
Denial of Service Attack
A hacker may be able to prevent your network from operating or communicating by launching a
Denial of Service (DoS) attack. The method used for such an attack can be as simple as merely
flooding your site with more requests than it can handle. A more sophisticated attack may attempt
to exploit some weakness in the operating system used by your router or gateway. Some operating
systems can be disrupted by simply sending a packet with incorrect length information.
Ethernet Cabling
Although Ethernet networks originally used thick or thin coaxial cable, most installations currently
use unshielded twisted pair (UTP) cabling. The UTP cable contains eight conductors, arranged in
four twisted pairs, and terminated with an RJ45 type connector. A normal straight-through UTP
Ethernet cable follows the EIA568B standard wiring as described below in
Table B-1
.
Category 5 Cable Quality
Category 5 distributed cable that meets ANSI/EIA/TIA-568-A building wiring standards can be a
maximum of 328 feet (ft.) or 100 meters (m) in length, divided as follows:
20 ft. (6 m) between the hub and the patch panel (if used)
295 ft. (90 m) from the wiring closet to the wall outlet
Table B-1.
UTP Ethernet cable wiring, straight-through
Pin
Wire color
Signal
1
Orange/White
Transmit (Tx) +
2
Orange
Transmit (Tx) -
3
Green/White
Receive (Rx) +
4
Blue
5
Blue/White
6
Green
Receive (Rx) -
7
Brown/White
8
Brown
Page 148 / 234
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
B-12
Networks, Routing, and Firewall Basics
May 2004, 202-10030-02
10 ft. (3 m) from the wall outlet to the desktop device
The patch panel and other connecting hardware must meet the requirements for 100 Mbps
operation (Category 5). Only 0.5 inch (1.5 cm) of untwist in the wire pair is allowed at any
termination point.
A twisted pair Ethernet network operating at 10 Mbits/second (10BASE-T) will often tolerate low
quality cables, but at 100 Mbits/second (10BASE-Tx) the cable must be rated as Category 5, or
Cat 5, by the Electronic Industry Association (EIA). This rating will be printed on the cable jacket.
A Category 5 cable will meet specified requirements regarding loss and crosstalk. In addition,
there are restrictions on maximum cable length for both 10 and 100 Mbits/second networks.
Inside Twisted Pair Cables
For two devices to communicate, the transmitter of each device must be connected to the receiver
of the other device. The crossover function is usually implemented internally as part of the
circuitry in the device. Computers and workstation adapter cards are usually media-dependent
interface ports, called MDI or uplink ports. Most repeaters and switch ports are configured as
media-dependent interfaces with built-in crossover ports, called MDI-X or normal ports.
Auto
Uplink technology automatically senses which connection, MDI or MDI-X, is needed and makes
the right connection.
Figure B-1
illustrates straight-through twisted pair cable.
Figure B-1:
Straight-Through Twisted-Pair Cable
Figure B-2
illustrates crossover twisted pair cable.
Page 149 / 234
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
Networks, Routing, and Firewall Basics
B-13
May 2004, 202-10030-02
Figure B-2:
Crossover Twisted-Pair Cable
Figure B-3:
Category 5 UTP Cable with Male RJ-45 Plug at Each End
Note
: Flat “silver satin” telephone cable may have the same RJ-45 plug. However, using telephone
cable results in excessive collisions, causing the attached port to be partitioned or disconnected
from the network.
Uplink Switches, Crossover Cables, and MDI/MDIX Switching
In the wiring table above, the concept of transmit and receive are from the perspective of the PC,
which is wired as Media Dependant Interface (MDI). In this wiring, the PC transmits on pins 1 and
2. At the hub, the perspective is reversed, and the hub receives on pins 1 and 2. This wiring is
referred to as Media Dependant Interface - Crossover (MDI-X).
Page 150 / 234
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
B-14
Networks, Routing, and Firewall Basics
May 2004, 202-10030-02
When connecting a PC to a PC, or a hub port to another hub port, the transmit pair must be
exchanged with the receive pair. This exchange is done by one of two mechanisms. Most hubs
provide an Uplink switch which will exchange the pairs on one port, allowing that port to be
connected to another hub using a normal Ethernet cable. The second method is to use a crossover
cable, which is a special cable in which the transmit and receive pairs are exchanged at one of the
two cable connectors. Crossover cables are often unmarked as such, and must be identified by
comparing the two connectors. Since the cable connectors are clear plastic, it is easy to place them
side by side and view the order of the wire colors on each. On a straight-through cable, the color
order will be the same on both connectors. On a crossover cable, the orange and blue pairs will be
exchanged from one connector to the other.
The FVL328 Firewall incorporates Auto Uplink
TM
technology (also called MDI/MDIX). Each
LOCAL Ethernet port will automatically sense whether the Ethernet cable plugged into the port
should have a normal connection (e.g. connecting to a PC) or an uplink connection (e.g.
connecting to a router, switch, or hub). That port will then configure itself to the correct
configuration. This feature also eliminates the need to worry about crossover cables, as Auto
Uplink
TM
will accommodate either type of cable to make the right connection.

Rate

4 / 5 based on 1 vote.

Bookmark Our Site

Press Ctrl + D to add this site to your favorites!

Share
Top