Security Architecture · Topic 4 of 6
Firewalls, VPNs and Secure Access
Security+ firewall types and rules, VPN designs, IPsec tunnel and transport modes, split tunneling, SD-WAN, SASE and 802.1X port based access control.
- 5 min
- Includes a diagram
- A stateful firewall tracks connections, and a stateless filter does not.
- An NGFW adds application awareness and integrated intrusion prevention.
- A WAF protects web applications. UTM combines many functions in one box.
What it is
This page covers the controls that filter traffic and protect connections: firewalls, virtual private networks (VPNs), and modern secure access services.
A firewall decides which traffic may pass. A VPN protects traffic that travels across an untrusted network by encrypting it.
How it works
Firewall types
| Type | How it decides |
|---|---|
| Stateless packet filter | Checks each packet alone against rules on addresses and ports |
| Stateful firewall | Tracks connections, so return traffic for an allowed session is permitted |
| Next generation firewall (NGFW) | Stateful filtering plus application awareness, user identity and an integrated intrusion prevention system (IPS) |
| Web application firewall (WAF) | Inspects web traffic for attacks against applications |
| Unified threat management (UTM) | One appliance combining firewall, filtering, antivirus and more |
| Layer 4 firewall | Works on addresses, ports and protocols |
| Layer 7 firewall | Understands the application, such as the web request itself |
Rules are processed from top to bottom, and the first match applies. Most rule sets end in an implicit deny, which blocks anything not allowed. A rule normally lists source, destination, port, protocol and an action of allow or deny.
Virtual private networks
A VPN builds an encrypted tunnel across another network. There are two common shapes.
| Shape | Use |
|---|---|
| Remote access VPN | One user connects to the company network |
| Site to site VPN | Two networks are linked, for example head office and branch |
Internet Protocol Security (IPsec) is a suite that protects traffic at the network layer. It uses the Internet Key Exchange (IKE) to set up keys, and the Encapsulating Security Payload (ESP) to encrypt data. A Transport Layer Security (TLS) VPN uses the same technology as secure web browsing and works well through most firewalls.
| IPsec mode | Description |
|---|---|
| Transport | Protects the payload and keeps the original IP header, used host to host |
| Tunnel | Wraps the whole original packet in a new one, used between gateways |
A full tunnel sends all traffic through the VPN. A split tunnel sends only company traffic through it, which saves bandwidth but lets other traffic skip company inspection.
Software defined WAN and SASE
Software defined wide area network (SD-WAN) manages connections between sites through software, choosing the best path across links such as broadband and cellular. Secure access service edge (SASE) combines network functions and cloud delivered security, such as secure web gateways and zero trust access, into one service close to the user.
Port based access control
The 802.1X standard controls access at the switch port or wireless connection. The device (supplicant) asks the switch or access point (authenticator) for access, and an authentication server such as a Remote Authentication Dial In User Service (RADIUS) server decides. The Extensible Authentication Protocol (EAP) carries the credential exchange.
Selecting effective controls
Choose the control that fits the stated risk. A web application attack calls for a WAF, remote staff calls for a VPN or zero trust access, and unauthorized devices on a switch call for 802.1X.
What to remember for the exam
- A stateful firewall tracks connections, and a stateless filter does not.
- An NGFW adds application awareness and integrated intrusion prevention.
- A WAF protects web applications. UTM combines many functions in one box.
- Rules are read top down, and an implicit deny blocks what is not allowed.
- IPsec tunnel mode protects the whole packet and is typical for gateway to gateway links.
- A split tunnel sends only some traffic through the VPN.
- SD-WAN manages branch connectivity, and SASE delivers network and security services from the cloud.
- 802.1X uses a supplicant, an authenticator and an authentication server.
A scenario that mentions application names or users in firewall rules points to a next generation firewall, not a basic packet filter.
Common mistakes
Putting the allow rule below a deny rule. The first matching rule wins, so order changes the result.
Assuming a VPN makes the endpoint safe. It protects the traffic in transit, but a compromised laptop can still bring malware into the network.
Confusing a WAF with a network firewall. A WAF reads web requests, and a network firewall mainly looks at addresses and ports.
Thinking split tunneling is always bad. It saves bandwidth, but it also means some traffic skips inspection, which is a risk to weigh.
Mixing up SD-WAN and SASE. SD-WAN is about connecting sites efficiently. SASE adds cloud security services.
Do not remove an implicit deny. A firewall that allows everything not listed provides very little protection.
Check yourself
What is the difference between stateless and stateful firewalls?
A stateless filter checks each packet alone, while a stateful firewall tracks connections and allows return traffic for permitted sessions.
What is a split tunnel?
A VPN setup in which only traffic for the company network uses the tunnel and other traffic goes directly to the internet.
Which standard controls access at a switch port?
The Institute of Electrical and Electronics Engineers (IEEE) 802.1X standard, which uses an authentication server to decide who may connect.
Topic 4 of 6 in Security Architecture
Test yourself on Security Architecture
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.