Let’s talk a little bit more about Firewalls and Network Databases.
The obvious insight most networking people have is that the purpose of IP is to find a route between A and B. If there is a path, IP will find it.
The problem is that the network is a graph that isn’t owned by anyone. Anyone can create a connection, and any connection can create a path and any path can lead A to B.
The really annoying problem is that because the graph is built on physical cables that are very expensive to put in the ground, a single physical cable can be a path that is open to some packets and closed to others.
In other words, some links from A to B are valid because the person at A is allowed to talk to B, and some are not. And the amount of state you need to inspect to determine if packet A is allowed to go from A to B is considerable.
Really obvious stuff.
If you want to control traffic going that goes through a physical cable then you have to put a device that can look at all of the traffic coming in on the physical cable and make routing decisions. The device has to have a notion of forwarding paths and rules about how the data can flow through the device.
And that’s what a firewall does. First the firewall makes sure the packet is allowed to go through the firewall at all, then the firewall looks at where the packet wants to go next, and sees if the packet is allowed to based on the security policy.
From a particular point of view a firewall is just a router that uses a different kind network database. However, the database properties of the firewall are very different.
What is very confusing, especially to the networking industry, is that because firewalls are really just a router that has a different kind of database, it’s easy to assume that a firewall is a router and that the same kind of system level insights that apply to routers apply to firewalls.
And that’s unfortunate. Because a firewall system design is better informed from the system design of scalable web applications that have centralized databases than routers or switches.
More to come.
Leave a Reply