Chapter 12. What Is My Firewall Telling Me?

You have purchased, installed, configured, and are running a firewall. You think it is doing a marvelous job of protecting resources and keeping your network safe and secure. But is it really doing those things? Network and security data and information are arguably the most valuable assets in a firewall administrator's toolbox when combined with the knowledge of how to use them. Firewall data and information greatly increase your ability to identify security compromises and assist in general troubleshooting and maintenance. The challenge, of course, is obtaining this information and knowing what to do with it when you have it.

All mainstream firewalls today provide some method of logging data and information from the firewall. Collecting, reviewing, and understanding what to do with this information will make your job easier. Specifically, you can figure out what your firewall is telling you and with that information you can develop a solution as required.