Helpful first: OSI and TCP/IP layers, encapsulation, and protocol attacks · Least privilege, defense in depth, and Zero Trust boundaries
Key points
- Contrast static packet filtering (L3/L4 stateless), stateful inspection (connection table), application proxies, NGFWs, and WAFs
- Design DMZ / Screened Subnet topologies, East-West microsegmentation, and Purdue Model OT/ICS air-gaps/unidirectional gateways
- Explain how IEEE 802.1X (Supplicant, Authenticator, Authentication Server via RADIUS/EAP-TLS) and SASE/Zero Trust SDP govern access
Five firewall types and Forward vs Reverse proxies
Not all firewalls see the same picture. A first-generation Stateless Packet Filtering firewall (such as a basic router ACL) inspects only the Layer 3 IP addresses and Layer 4 TCP/UDP port numbers of each individual packet in isolation. Because it keeps no memory of prior packets, it cannot tell whether an incoming ACK packet belongs to a legitimate outbound request or an attacker’s ACK scan.
A Stateful Inspection firewall solves this by maintaining a dynamic State Table of active connections. When an internal host initiates a TCP handshake (SYN -> SYN-ACK -> ACK), the firewall records the 5-tuple (src IP, dst IP, src port, dst port, protocol) and automatically allows matching return traffic while dropping unsolicited inbound packets. A Circuit-Level Gateway (such as a SOCKS proxy at Layer 5) validates the session handshake before relaying bytes without inspecting deep application content.
At Layer 7, an Application-Level Gateway (Proxy Firewall), Next-Generation Firewall (NGFW), or Web Application Firewall (WAF) terminates and re-originates connections to inspect the actual payload. A WAF specifically protects web applications and APIs against OWASP Top 10 attacks (SQL injection, XSS, SSRF). Architects also pair two proxy directions: a Forward Proxy represents internal users calling out to the internet (enforcing URL filtering, caching, and outbound DLP while hiding internal client IPs), whereas a Reverse Proxy sits in front of Meridian’s origin servers (terminating TLS, load-balancing, and hiding internal server IPs from internet callers).
| Control type | Highest OSI layer | How it decides and what it stops |
|---|---|---|
| Stateless Packet Filter (ACL) | Layer 3 / 4 | Matches individual packet headers against static rules; fast, but blind to connection state or payload. |
| Stateful Inspection Firewall | Layer 3 / 4 (State Table) | Tracks active TCP/UDP sessions in a state table; blocks unsolicited inbound packets that do not match an established flow. |
| Next-Gen Firewall (NGFW) | Layer 7 | Combines stateful inspection with Deep Packet Inspection (DPI), Intrusion Prevention (IPS), and directory user/group awareness. |
| Web Application Firewall (WAF) | Layer 7 (HTTP/HTTPS) | Inspects HTTP verbs, headers, cookies, and JSON/form bodies against SQLi, XSS, and bot abuse. |
| Forward vs Reverse Proxy | Layer 7 | Forward Proxy protects/hides internal clients going out; Reverse Proxy protects/hides internal origin servers from external clients. |
Screened subnets (DMZ), East-West microsegmentation, and OT zones
Perimeter architecture uses a Screened Subnet (traditionally called a Demilitarized Zone, or DMZ) created by either a multi-homed firewall or two separate firewalls (an outer perimeter firewall facing the internet and an inner firewall protecting the internal LAN). Publicly reachable services (such as web reverse proxies, mail relays, and authoritative DNS) sit inside the DMZ, while databases and domain controllers sit behind the inner firewall so a compromised web frontend cannot directly reach internal crown jewels.
However, traditional VLANs only filter North-South traffic (entering or leaving a subnet) while allowing unrestricted East-West lateral movement between hosts on the same VLAN. Zero Trust Microsegmentation enforces granular, identity- and workload-aware firewall policies on every individual host or container interface (using eBPF, hypervisor vSwitches, or mTLS service meshes) so a compromised node cannot scan its neighbors.
In industrial and aerospace Operational Technology (OT / ICS / SCADA) environments governed by the Purdue Model and NIST SP 800-82, availability and physical safety come first: legacy programmable logic controllers (PLCs) are isolated in dedicated cell zones behind industrial firewalls or physical Unidirectional Security Gateways (Data Diodes) that physically allow light to travel in only one direction.
Network Access Control (IEEE 802.1X), Zero Trust SDP, and SASE
Before a device is even assigned an IP address on a wired switch port or enterprise Wi-Fi network, Network Access Control (NAC) verifies its identity and health posture. The foundation of NAC is IEEE 802.1X Port-Based Network Access Control, which defines three strict architectural roles: the Supplicant (the client laptop or IoT device requesting access), the Authenticator (the Layer 2 Ethernet switch or wireless access point acting as a gatekeeper), and the Authentication Server (typically a RADIUS server that validates credentials or X.509 certificates).
Until the Authentication Server sends an RADIUS Access-Accept message, the Authenticator blocks all traffic on the port except 802.1X Extensible Authentication Protocol over LAN (EAPoL) frames. The strongest authentication method inside 802.1X is EAP-TLS, which requires mutual X.509 certificates on both the client device (stored in its TPM) and the RADIUS server. Modern NAC also runs posture assessment (checking OS patch level and EDR health) and places non-compliant devices into a restricted remediation/quarantine VLAN.
For remote and cloud-first workforces, organizations increasingly replace legacy split-tunnel VPNs with Software-Defined Perimeter (SDP / ZTNA) and Secure Access Service Edge (SASE), which combine SD-WAN with cloud-delivered Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Firewall-as-a-Service (FWaaS), and Zero Trust Network Access (ZTNA) to broker per-application connections after verifying user identity and device posture.
CHECK YOUR JUDGMENT
Vera Vance and Kael Cho are deploying IEEE 802.1X with EAP-TLS across all wired switch ports in Meridian’s engineering building (chronos.orbital). When an engineer plugs a company laptop into a wall jack, which component acts as the 802.1X Authenticator that holds the port closed until the RADIUS server verifies the laptop’s certificate?
NEXT FIELD LESSON