1

From my understanding, a Layer 3 switch can handle cross-communication between separate LANs and VLANs, as well as fine-tuned ACL control between VLANs.

Despite this, I know a Layer 3 switch should definitely not be used in place of a Firewall, such as between your LAN and WAN.

What are some examples of the primary advantages of a Firewall over a Layer 3 switch in guarding your network, on top of ACLs?

4

Firewalls are usually stateful. Usually, you want a firewall to block everything but established communication, and this can be difficult to impossible with ACLs, depending on the router or switch vendor and software version. Some devices (router or switch) support reflexive ACLs that can be stateful, but they are more limited, and it becomes a large burden to to maintain.

Next-generation firewalls can also look beyond the network traffic into the application data in order to block/allow applications.


Edit:

If you set up a traditional ACL to block all incoming traffic (firewall default behavior), then a host requesting data from outside could never get the data because the ACL will block all incoming traffic.

A reflexive ACL could see the outbound connection, and it can be configured to reflect (allow traffic back on that connection). This behavior maintains a connection state. This is basically what a firewall does; it maintains the state of a connection, up to a timeout period of inactivity. It will again block when the connection is closed.

A next-generation firewall goes even further. It will be able to do deep packet inspection to deterministically or heuristically determine what type of data is passing through, or which application is communicating. That adds flexibility to block or allow in a more finely-grained fashion. For example, the firewall could actually detect and block malware in a data stream, it could block a torrent, or you could allow only traffic to and from a single application on a particular host. This type of firewall needs to have a maintenance contract that allows the software to be updated to stay current.

| improve this answer | |
  • Thanks. Is there any way you could give a few real-life examples of this? – dthree Jan 5 '17 at 0:21
  • I'm not sure what you mean. – Ron Maupin Jan 5 '17 at 0:22
  • Such as an example of insecure traffic coming that isn't on an established session, or examples of higher-layer application data that could be inspected. – dthree Jan 5 '17 at 0:35
  • I edited my answer. Protocols above OSI layer-4 are explicitly off-topic here. A complete discussion of these is too large for this site. Simple searches for reflexive access list and next-generation firewall wiil give you good information on each. – Ron Maupin Jan 5 '17 at 0:41
2

The line between firewall and gateway (aka router) continues to get blurred. Each device advances to include the others features. However, fundamentally, a routers job is to route packets whereas a firewalls job is to inspect and control connections through the device.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.