The previously mentioned policies focus primarily on defining the requirements and expectations of the firewall and interrelated systems. | Firewall Policies Rulesets The previously mentioned policies focus primarily on defining the requirements and expectations of the firewall and interrelated systems. After the requirements have been defined however you must actually build the configuration and ruleset that the firewall will use. Although somewhat confusing this is also commonly referred to as the firewall security policy even though practically the firewall security policy is better defined as a combination of standards guidelines and procedures than a policy per se. For this reason I like to think of the firewall policy more in terms of the firewall ruleset to ensure that there is a distinction between the security policies that define the requirements and the security policies or ruleset that define the actual rule configuration that adheres to the defined requirements. Generally speaking three common rulesets need to be defined for the firewall Ingress filters Egress filters Management-access ruleset Ingress Filters Ingress filters are used to restrict traffic coming into an interface or from a given network segment. Ingress filters are commonly applied to traffic coming from an untrusted source such as the Internet or a DMZ segment to a trusted source such as a DMZ or internal network respectively . To really get comfortable with the concept of ingress filters it is important to understand that a filter is an ingress filter relative to the direction and source of the traffic being filtered. For example if you consider a simple single firewall configuration with a one-armed DMZ segment potentially two ingress filters would apply to the firewall as pointed out in Figure 10-3. Figure 10-3. Ingress Filters View full size image As you can see by the traffic-flow arrows traffic can flow from the Internet to the DMZ segment from the DMZ segment to the internal network from the internal network to either the DMZ or the Internet and from the DMZ to the Internet these last two scenarios are technically .
