35. So which type of firewall is better than the others?

The fact is, each firewall architecture has its merits and drawbacks. Let’s review the features of all major firewall types. Router screening is fast and allows rejection of common errors, cracker attacks, and user strangeness which is part of any network connection. Application filtering firewalls provide extensive application control and monitoring of application behavior. Proxy facilities provide application control and session control between sources and destinations as well as address translation facilities. Stateful firewalls allow technical attacks from breaching a network and provide sophisticated filtering techniques that rival almost any proxy or application gateway. In short, almost all firewall approaches have strengths and weaknesses. In fact, this is a good thing for customers. What is best for the customer is security, implemented for the right reasons and in the most productive manner. This means that the optimal firewall configuration is one that can perform all the various types of rule-based filtering previously described depending on the type of application being used and the best security methodology approach to solve the security problem for the application environment. No single security rule-based approach that has been described can properly address all security issues in a networked environment. Most network security experts will tell you that it is impractical to expect one approach to be useful in all environments. A list of other security features that you might want to consider when evaluating routers or firewalls is given in Table 16.3

Table 16.3. Additional Router-Firewall Security Features to Consider

Feature	Description
Audit Trail	Records all session activities, including source and destination hosts, ports, duration, time stamp, and bytes transmitted.
Authentication Proxy	Authenticates users as being authorized to access a LAN.
Denial of Service (DoS) Detection and Prevention	Examines packet headers and filters those deemed suspicious.
Intrusion Detection	Monitors network traffic for known security breaches, filters out suspect packets, and sends alert notice to management console.
Java Applet Blocking	Filters Java applets from unknown or untrusted sources.
Traffic Filtering	Enables network administrator to specify traffic that is permitted to access the network.
Source: Adapted from Wexler, 2001.