3.2 Network Defense Infrastructure & Firewalls

3.2 Network Defense Infrastructure & Firewalls

Quick Summary: Perimeter defense establishes strict control over network ingress and egress points. Firewalls inspect traffic using mechanisms ranging from stateless packet filtering to stateful connection tracking and Next-Generation Firewall (NGFW) deep packet inspection. Wireless infrastructure defenses secure radio frequency (RF) networks by evolving from legacy broken ciphers (WEP, WPA) to modern WPA2/WPA3 standards and IEEE 802.1X Enterprise authentication.

Firewalls and wireless infrastructure security represent mandatory defensive layers in modern enterprise architectures. Controlling what network traffic is allowed to enter or leave an organization's boundaries prevents unauthorized network intrusions, mitigates malware command-and-control (C2) channels, and enforces compliance policies across both wired and wireless transmission mediums.

---

1. Evolution & Classification of Firewall Technologies

Firewalls are dedicated hardware appliances or software security controls designed to inspect incoming and outgoing network traffic against a set of predefined security rules. Over decades of protocol development, firewalls have evolved through distinct technological generations to counter increasingly sophisticated evasions.

Generation 1: Stateless Packet Filtering Firewalls

Operate primarily at OSI Layers 3 and 4. Stateless firewalls inspect individual network packets in isolation based strictly on static header fields: Source IP, Destination IP, IP Protocol (TCP/UDP/ICMP), Source Port, and Destination Port.

• Operational Logic: Evaluates each packet independently without maintaining connection context.
• Pros: Extremely fast processing speed; minimal CPU and RAM hardware overhead.
• Cons: Completely blind to session state and packet relationships. Vulnerable to IP spoofing, TCP ACK flag manipulation, and application-layer attacks.

Generation 2: Stateful Inspection Firewalls

Operate at OSI Layers 3, 4, and 5. Stateful firewalls maintain a dynamic State Table that tracks active network connection states (e.g., TCP 3-way handshake states: SYN_SENT, SYN_RECV, ESTABLISHED).

• Operational Logic: When an internal host initiates an outbound connection, the firewall records source/destination IP and port numbers in its state table. When the external server responds, return traffic matching an established connection is permitted automatically without needing explicit inbound ACL rules.
• Pros: Prevents unsolicited incoming connection attempts; defeats TCP ACK spoofing attacks.
• Cons: Consumes hardware RAM to maintain state tables; vulnerable to State Table Exhaustion Denial-of-Service (DoS) attacks.

Generation 3: Application-Layer Gateways (Proxy Firewalls)

Operate at OSI Layer 7. Proxy firewalls act as complete protocol intermediaries, breaking direct end-to-end connections between clients and destination servers. The client connects directly to the proxy, which evaluates the application payload before initiating a separate connection to the destination.

• Pros: Inspects complete application command structures and payloads; masks internal network addressing.
• Cons: Introduces heavy processing latency; requires custom proxy code for each application protocol.

Modern Standard: Next-Generation Firewalls (NGFW)

Modern enterprise perimeters deploy Next-Generation Firewalls (NGFW), such as Cisco Secure Firewall. NGFWs combine stateful inspection with advanced deep-inspection engines:

1. Deep Packet Inspection (DPI): Reassembles packet streams to inspect payload content regardless of destination port numbers.
2. Application Visibility and Control (AVC): Identifies specific applications regardless of standard ports (e.g., detecting BitTorrent or Tor running over TCP port 443).
3. Integrated Intrusion Prevention System (IPS): Executes real-time threat signature matching and behavioral anomaly detection.
4. User & Identity Awareness: Integrates with Active Directory or Cisco ISE to enforce rules based on individual user identity rather than static IP addresses.
5. TLS/SSL Decryption & Inspection: Decrypts outbound and inbound encrypted traffic to expose hidden malware payloads.
6. Threat Intelligence Integration: Dynamically updates IP reputation and malware signature feeds from threat research centers (such as Cisco Talos).

2. Wireless Security & Infrastructure Defense

Wireless local area networks (WLANs) eliminate physical cabling constraints but expand the network perimeter beyond physical building walls. Because radio frequency (RF) signals propagate freely through air, robust cryptographic encryption standards and centralized authentication frameworks are mandatory.

Evolution of IEEE 802.11 Encryption Standards

1. Wired Equivalent Privacy (WEP) - Deprecated & Unsafe: Uses RC4 stream cipher with a static 24-bit Initialization Vector (IV). Rapid IV reuse (IV Collisions) allows tools like Aircrack-ng to recover WEP encryption keys in minutes.
2. Wi-Fi Protected Access (WPA) - Deprecated: Introduced Temporal Key Integrity Protocol (TKIP) with a 48-bit IV as an interim patch, but inherited core RC4 architectural weaknesses.
3. Wi-Fi Protected Access 2 (WPA2 - IEEE 802.11i): Mandated Advanced Encryption Standard (AES) with Counter Mode CBC-MAC Protocol (CCMP). Provides strong 128-bit encryption. However, WPA2-Personal Pre-Shared Key (PSK) 4-way handshakes are vulnerable to offline dictionary attacks and KRACK exploits.
4. Wi-Fi Protected Access 3 (WPA3): Replaces PSK with Simultaneous Authentication of Equals (SAE) (Dragonfly key exchange), eliminating offline dictionary attacks and providing Forward Secrecy. Mandates Protected Management Frames (PMF / 802.11w) to prevent deauthentication DoS attacks.

Wireless Authentication: Personal vs. Enterprise (802.1X)

• WPA Personal Mode (PSK / SAE): Uses a single pre-shared passphrase across all connected devices. Offers no individual user accountability; if one employee leaves, the password must be changed on all devices.
• WPA Enterprise Mode (IEEE 802.1X / EAP): Enforces individual user authentication. Wireless clients (Supplicants) authenticate through the Access Point (Authenticator) to a centralized RADIUS server (e.g., Cisco ISE).
  • EAP-TLS: Most secure EAP method; requires mutual digital certificates installed on both server and client endpoint.
  • PEAP (Protected EAP): Establishes an encrypted TLS tunnel using the server's digital certificate, protecting inner MS-CHAPv2 password authentication.

RF Threat Vectors & Countermeasures

• Rogue Access Points: Unauthorized APs plugged into internal switch ports. Mitigated via 802.1X switch port security and Wireless IPS (WIPS).
• Evil Twin Attacks: Attacker deploys a rogue AP broadcasting the exact same SSID as a legitimate network to intercept credentials. Mitigated via WIPS and EAP-TLS certificate validation.
• Deauthentication Floods: Spoofed 802.11 management frames that disconnect legitimate users. Mitigated via 802.11w Protected Management Frames (PMF).

---

3. Setting Up a Secure Wireless SoHo Network

Blueprint sub-topic 2.4 is unusual in Domain 2 because it is phrased as a task — "set up a secure wireless SoHo network" — rather than as a concept to explain. SoHo means Small office / Home office: a single all-in-one router/AP, no RADIUS server, no controller, and no dedicated IT staff. Exam items typically present a home or small-branch router configuration and ask which change most improves its security posture.

The SoHo hardening checklist

SSID configuration: what actually helps

The SSID is the network's advertised name, broadcast in beacon frames roughly ten times per second.

• Renaming the SSID away from the vendor default is genuinely useful, because default names disclose the manufacturer and often the model.
• Do not encode identifying information — Smith_Family_5G or AcmeDental_Reception tells an attacker exactly whose network they have found and where it is.
• Disabling SSID broadcast is not a security control. It removes the name from beacon frames, but the SSID still travels in the clear inside association and probe-request frames, so any wireless analyser recovers it in seconds. Worse, client devices configured for a hidden network then broadcast probe requests for that SSID wherever they go, which makes those clients easier to track and to lure onto an evil-twin AP. Treat "hide the SSID" as an exam distractor: it is obscurity, not security.

MAC address filtering: what it is and what it is not

MAC address filtering configures the access point with an allow-list (or block-list) of client hardware addresses. It is named explicitly in the blueprint, and the exam expects you to know both halves of the story:

• What it does: stops a casual or opportunistic device from associating, and gives a small office a rough inventory of which devices are permitted.
• Why it is weak: MAC addresses are transmitted unencrypted in every frame header, even on a WPA3 network, because the header must be readable for the frame to be delivered. An attacker passively captures a permitted MAC in seconds and then spoofs it with a single command. MAC filtering is also administratively painful — every new phone, laptop, and visitor requires a manual entry — and modern devices use randomised MAC addresses by default for privacy, which breaks the allow-list every time a client rotates its address.
• Correct exam framing: MAC filtering is a supplementary, defence-in-depth measure. If an option offers MAC filtering instead of strong encryption, it is wrong. If it offers MAC filtering in addition to WPA3 on a small network, it is a reasonable minor hardening step.

Additional SoHo considerations

• Transmit power and placement: positioning the AP centrally and reducing transmit power limits how far the signal leaks into car parks and neighbouring units. Physical containment is a real, if partial, control.
• Band and channel: 5 GHz and 6 GHz have shorter range than 2.4 GHz, which incidentally reduces external exposure.
• Router-level firewall: SoHo routers include a stateful firewall enabled by default. Verify it is on, and confirm no leftover port-forwarding or DMZ-host setting exposes an internal machine wholesale.

---

4. Network Access Control (NAC)

Network Access Control (NAC) completes blueprint sub-topic 2.5 alongside ACLs, firewalls, and VPNs. Where a firewall controls what traffic may pass, NAC controls which devices may join the network at all, and on what terms.

How NAC works

1. Authentication. The device or user proves identity, typically via IEEE 802.1X — the client (supplicant) authenticates through the switch or AP (authenticator) to a RADIUS server such as Cisco Identity Services Engine (ISE).
2. Posture assessment. NAC checks the endpoint's health against policy: is the OS patched, is antimalware installed and current, is disk encryption enabled, is the host firewall on?
3. Authorisation and enforcement. Based on identity plus posture, the device is placed into an appropriate VLAN and given a matching access policy.
4. Remediation. A device failing posture checks is moved to a quarantine VLAN with access only to update and remediation servers until it complies.

NAC deployment models

Why NAC matters for the topics around it

NAC is the practical answer to several threats covered elsewhere in this chapter: it stops the rogue access point plugged into an unsecured wall port, it prevents an unmanaged personal laptop from joining the corporate LAN, it enforces the BYOD policies covered in Section 4.4, and it supplies the network-level isolation that incident responders use to contain a compromised host (Section 6.2). It is also the natural enforcement point for a Zero Trust posture, because it re-evaluates trust at the moment of connection rather than assuming that anything on the internal network is safe.