On Fri, 6 Jun 1997, Eric Vyncke wrote:
> Craig,
>
> Cannot resist to reply :-) Beware that I'm working for Cisco Systems ;-)
Is cool.
> I both agree and disagree:
>
> 1) NAT is NOT a security feature, I agree thus 200% with you
>
> - PIX is very strong due to its fullstate inspection against
> attacks for IP, TCP, ... protocols: SYN flooding, IP spoofing,
> TCP/IP session hijakcing, ... It also randomized the TCP sequence
> numbers of the TCP sessions going through it
I do not agree that 'fullstate inspection' makes PIX 'very strong'. See
previous thread. I'm reluctant to start yet another SMLI vs. App Proxy
showdown.
> - PIX knows about the internal of some protocols (from ICMP, to RealAudio
> via HTTP) and is able to check / react on these protocols
Can I write filters for PIX that will be aware of the internals of
protocols? Or do I have ot wait for Cisco to write them?
Craig Brozefsky craig @
onshore .
com
onShore Inc. http://www.onshore.com/~craig
Development Team p_priority=PFUN+(p_work/4)+(2*p_cash)
References:
|
|
