Network Security Guide — Firewalls, VPNs, ACLs, and Zero Trust

Network security protects the integrity, confidentiality, and availability of a network and its data. It encompasses firewalls, VPNs, access control, intrusion detection, encryption, and architectural principles like Zero Trust — all working together to defend against unauthorized access, attacks, and data breaches.

The CIA Triad — Foundation of Network Security

Every security decision maps back to three core principles:

• Confidentiality: Only authorized users can access data (encryption, access control)
• Integrity: Data is not modified in transit or at rest (hashing, digital signatures)
• Availability: Systems are accessible when needed (redundancy, DDoS protection, backups)

Network Threats — What You’re Defending Against

Firewalls — Your First Line of Defense

A firewall controls traffic entering and leaving a network segment based on rules. Two fundamental types:

• Stateless firewall: Examines each packet independently against ACL rules — fast but limited
• Stateful firewall: Tracks connection state — knows if a packet is part of an established session. Much more intelligent and the standard today.
• Next-Generation Firewall (NGFW): Deep packet inspection, application awareness, IPS integration, user identity — Palo Alto, Cisco Firepower, Fortinet FortiGate

Access Control Lists (ACLs)

ACLs are ordered permit/deny rules applied to router interfaces to filter traffic:

• Standard ACL (1–99): Filters by source IP only — place near destination
• Extended ACL (100–199): Filters by source IP, destination IP, protocol, port — place near source
• Named ACL: Preferred — easier to edit, delete individual lines, descriptive names

Key rules: Processed top-down (first match wins). Implicit deny all at the end. Always keep at least one permit statement.

VPN — Virtual Private Networks

VPNs create encrypted tunnels over public networks, allowing secure communication between remote locations or users.

VPN Types

• Site-to-Site VPN: Connects two office networks permanently — typically IPSec
• Remote Access VPN: Individual users connect securely from anywhere — SSL VPN or IPSec with client software
• MPLS VPN: ISP-managed private network — high reliability, not encrypted by default
• SD-WAN: Next-generation WAN — intelligent path selection across multiple transports including internet, MPLS, and LTE

IPSec VPN Protocols

Authentication Header (AH) — Protocol 51. Provides integrity and authentication but NO encryption. Incompatible with NAT.

ESP (Encapsulating Security Payload) — Protocol 50. Provides encryption, integrity, and authentication. Most commonly used in practice.

IPSec modes: Transport mode (host-to-host, only payload encrypted) | Tunnel mode (gateway-to-gateway, entire original packet encapsulated and encrypted).

Zero Trust Security

Zero Trust is a security model based on the principle: “Never trust, always verify.” No user or device is trusted by default — even inside the corporate network. Every access request must be authenticated, authorized, and continuously validated.

Zero Trust pillars:

• Identity verification (MFA, SSO)
• Device health validation (MDM, endpoint compliance)
• Least privilege access (need-to-know only)
• Microsegmentation (limit blast radius of breaches)
• Continuous monitoring and analytics

Intrusion Detection and Prevention

IDS (Intrusion Detection System) monitors network traffic for suspicious patterns and alerts administrators. It is passive — does not block traffic.

IPS (Intrusion Prevention System) sits inline and actively blocks malicious traffic in real time. NGFW appliances combine firewall + IPS in a single device.

• Signature-based: Matches known attack patterns — fast but misses zero-days
• Anomaly-based: Detects deviations from baseline — catches new attacks but prone to false positives

Network Segmentation and DMZ

Network segmentation divides a network into isolated zones, limiting an attacker’s movement if they breach one segment.

DMZ (Demilitarized Zone): A network segment between the internet and the internal network. Public-facing servers (web, email, DNS) live in the DMZ — separate from internal resources. If a DMZ server is compromised, the internal network is not directly accessible.

Segmentation methods: VLANs, physical separation, firewalls between zones, microsegmentation (software-defined).

Key Security Protocols

Layer 2 Security Features

• Port Security: Limits MAC addresses per port — prevents MAC flooding
• DHCP Snooping: Prevents rogue DHCP servers — builds binding table
• Dynamic ARP Inspection (DAI): Validates ARP packets against DHCP snooping table — prevents ARP spoofing
• IP Source Guard: Validates source IP against DHCP snooping table — prevents IP spoofing
• BPDU Guard: Shuts down PortFast-enabled port if BPDU received — prevents STP attacks

Security Cluster — All Articles

Fundamentals

• Zero Trust Security Complete Guide
• How to Improve Network Security
• Network Security Monitoring
• What is a Firewall?
• Stateful vs Stateless Firewall
• IDS and IPS Explained

VPN & Tunneling

• What is a VPN?
• Site-to-Site VPN
• What is Tunneling in Networking?
• CAPWAP Tunnel
• Authentication Header (AH) — IPSec

Access Control

• Access Control Lists (ACLs)
• DHCP Snooping

Frequently Asked Questions

What is the difference between IDS and IPS?

IDS (Intrusion Detection System) is passive — it monitors and alerts but does not block traffic. IPS (Intrusion Prevention System) is inline and active — it detects and blocks malicious traffic in real time. Modern NGFWs include integrated IPS functionality.

What is AAA in network security?

AAA stands for Authentication (who are you?), Authorization (what are you allowed to do?), and Accounting (what did you do?). RADIUS handles AAA for network access (WiFi, VPN, 802.1X). TACACS+ handles AAA for device management access (SSH into routers and switches).

How does Zero Trust differ from traditional perimeter security?

Traditional perimeter security trusts everything inside the corporate network by default — once you breach the firewall, you have broad access. Zero Trust eliminates the concept of a trusted inside network — every access request is verified regardless of origin, treating internal and external traffic as equally untrusted.

What is microsegmentation?

Microsegmentation divides the network into small, isolated security zones at the workload or application level — not just at the network perimeter. It limits lateral movement by attackers. Even if a server is compromised, the attacker cannot move freely to adjacent systems. Implemented via software-defined networking (SDN) or host-based firewalls.