Network Perimeter Protection · Topic 5 of 6
Firewall Selection, Deployment and Administration
Choose a firewall by inspection depth, follow a deployment process, apply rule base best practices and handle daily administration such as logs and audits.
- 5 min
- Default deny and least privilege rules are the two core practices.
- Rules are processed in order, and the first match wins on most firewalls.
- Deeper inspection costs performance, so size the device for traffic with inspection on.
What it is
Buying a firewall is the easy part. The defender must pick the inspection depth the risk demands, roll it out in a controlled way, write a safe rule base and then run it: reviewing logs, changing rules under control and keeping it patched.
The exam asks which firewall depth fits a requirement, the order of deployment steps, and what good rule and administration practice looks like.
How it works
Selecting by inspection capability
Deeper inspection finds more attacks, but it costs more processing and may need decryption.
| Inspection level | What it sees | Fits |
|---|---|---|
| Stateless filtering | Header fields of one packet | Simple edge routers, fast filtering |
| Stateful inspection | Headers plus connection state | General purpose perimeter |
| Deep packet inspection (DPI) | Packet payload against signatures and protocol rules | Block known exploits, identify applications |
| Application layer proxy | Full protocol content, one session at a time | High assurance for a few protocols |
| NGFW with IPS and threat feeds | Applications, users, content and reputation | Modern enterprise edge |
| TLS inspection | Decrypts, inspects, re encrypts traffic | Finds threats hidden in HTTPS |
Other selection factors: throughput under inspection, number of concurrent sessions, high availability, number of interfaces and zones, logging, central management, VPN support, vendor support and cost. Match the choice to the traffic: a small office does not need the same device as a data center.
TLS inspection has privacy and legal sides, since users' encrypted traffic is read. It needs a trusted internal certificate on endpoints, and some categories such as banking are often exempted by policy.
Implementation and deployment process
- Define requirements and policy: what must be allowed, what is the default stance, and what laws apply.
- Design the topology: zones, interfaces, DMZ, high availability and management network.
- Select the product and size it for peak traffic.
- Build the rule base: start with default deny, then add only needed allow rules.
- Harden the firewall itself: change default credentials, restrict and encrypt management access, patch.
- Test in a lab or off hours: rule logic, failover, logging, performance.
- Deploy in stages with a rollback plan, and tell users of changes.
- Monitor and tune after go live, and document the configuration.
Best practices for secure implementation
- Default deny: block everything not explicitly allowed. This is the key rule.
- Least privilege rules: specific source, destination and port, not "any".
- Order matters: most firewalls check rules top down and apply the first match, so specific rules come before general ones.
- Ingress and egress filtering: drop inbound packets with internal source addresses or private ranges, and restrict outbound traffic to stop data leaks and malware calls home.
- Block risky services at the edge, such as Telnet, NetBIOS and unneeded remote administration.
- Secure management: a separate management network, SSH or HTTPS only, multifactor for admins, no management from the internet.
- Time sync and logging: send logs to a central server with synchronized time.
- Use high availability so the firewall is not a single point of failure.
- Document every rule with an owner, reason and expiry or review date.
- Defense in depth: do not rely on the firewall alone.
Firewall administration activities
| Activity | Purpose |
|---|---|
| Change management | Rule changes are requested, approved, tested and recorded |
| Rule base review | Remove unused, duplicate, shadowed and overly broad rules on a schedule |
| Log monitoring | Watch denied traffic, scans, repeated failures and new outbound patterns |
| Configuration backup | Store versions securely so a bad change can be rolled back |
| Patching and firmware updates | Fix known firewall vulnerabilities |
| Access control for admins | Named accounts, role separation, review of who can change rules |
| Performance and capacity checks | Track CPU, session counts and throughput |
| Testing | Periodic vulnerability scans and penetration tests to check rules work |
| Audit | Compare the live rules with the written policy |
A shadowed rule is one that can never match because an earlier rule already catches the traffic.
A worked example
An administrator finds that a rule from two years ago allows any source to reach a test server on port 3389. The ticket has no owner and the server was retired.
Following the review process, the admin disables the rule, watches the logs for a week for hits, then removes it with an approved change. The final step is saving the new configuration and updating the rule documentation.
How the exam asks about this
- "What is the recommended default stance for a firewall rule base?" → Default deny, allowing only what is needed.
- "Which feature lets a firewall find threats in HTTPS traffic?" → TLS inspection, that is decrypting, inspecting and re encrypting.
- "What is the purpose of egress filtering?" → To limit outbound traffic so data leaks and malware callbacks are blocked.
What to remember for the exam
- Default deny and least privilege rules are the two core practices.
- Rules are processed in order, and the first match wins on most firewalls.
- Deeper inspection costs performance, so size the device for traffic with inspection on.
- Changes go through change management, and the rule base is reviewed on schedule.
- Logs, backups and patching are routine administration duties.
An "allow any any" rule at the top of a rule base defeats everything below it. Always check order and breadth, not just whether a rule exists.
Common mistakes
Skipping egress rules. Many teams filter only inbound traffic, which lets malware reach its command server.
Never cleaning the rule base. Old rules for retired systems become hidden holes.
Managing the firewall from the internet. Administration should only be reachable from a protected management network.
Check yourself
Why are specific rules placed before general ones?
Because the first matching rule is applied, so a general rule above would catch the traffic first.
What is a shadowed rule?
A rule that never matches because an earlier rule already handles the same traffic.
Why test a firewall before go live?
To confirm rules, failover, logging and performance work without breaking business traffic.
Topic 5 of 6 in Network Perimeter Protection
Test yourself on Network Perimeter Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.