Networking · Edge & Perimeter
Firewalls
Policy enforcement points that permit or deny traffic between network zones based on connection state, identity and application context.
Overview
Firewalls evolved from stateless packet filters to stateful inspection engines, and then to next generation platforms that identify applications and users regardless of port, decrypt TLS, and apply intrusion prevention and URL filtering in one pass.
A firewall is only as good as its zone model. The device enforces intent; the architecture, which segments exist, and which flows are legitimate between them, is where the real security decisions are made.
How it works
- 01Interfaces are assigned to zones (untrust, trust, DMZ, management, guest, server). Policy is written between zone pairs and evaluated top down until a match.
- 02Stateful inspection tracks each permitted session so return traffic is allowed implicitly, and invalid or out of window packets are dropped.
- 03Application identification inspects payload behaviour rather than trusting the port, which is what makes 'allow TCP/443' meaningfully different from 'allow Microsoft 365'.
- 04NAT policy is evaluated alongside security policy; understanding the order of NAT and policy lookup on your platform is essential to writing correct rules.
Why it matters
- It is the practical boundary between segments, and the enforcement point for east west as well as north south control.
- Firewall logs are a primary detection source for command and control, scanning and data egress.
- Rule quality drives audit outcomes: an unreviewed rule base accumulates risk silently.
Design considerations
- Default deny inbound and, increasingly, default deny outbound with explicit allowances.
- Group objects and tags by role so policy remains readable as the estate grows.
- Plan for high availability and for the throughput cost of decryption and IPS.
- Keep management planes out of band and behind privileged access controls.
Security considerations
- Review rules on a schedule; remove any/any, expired change window rules and unused objects.
- Log denies as well as allows, denies are how you spot reconnaissance.
- Do not expose management interfaces to the internet, and use MFA on administrative accounts.
- Track vendor advisories; internet facing firewalls are targeted directly.
Common misconfigurations
- Broad 'temporary' rules that are never removed.
- Rules ordered so a permissive early rule shadows a specific later one.
- Trusting internal zones completely, leaving lateral movement unfiltered.
- TLS inspection enabled without exclusions for pinned or regulated traffic, causing outages and shadow workarounds.
IT vs OT
OT perimeters usually add a demilitarised zone between the plant and enterprise networks with strict unidirectional or brokered data flows. OT firewall change control is far slower and often tied to maintenance windows.
IT Atlas covers Information Technology. Operational Technology is covered separately at otatlas.ai.