FW-001 Q: What is a firewall?
A: A firewall is a security device located at the network boundary, used to monitor and control traffic entering and leaving the network. Based on preset security rules, it decides to allow or block specific network communications, serving as the first line of defense in network security. A firewall can be a hardware device, a software program, or a cloud service.
FW-002 Q: What are the main functions of a firewall?
A: The core functions of a firewall include:
Packet filtering: Inspecting source/destination IP addresses and ports of packets;
Stateful inspection: Tracking connection states and only allowing return traffic for legitimate connections;
NAT translation: Hiding the internal network structure;
Application identification: Identifying and controlling specific applications (e.g., WeChat, P2P downloads);
Intrusion Prevention System (IPS): Detecting and blocking attack traffic;
VPN: Providing secure remote access.
FW-003 Q: What is the difference between a firewall and antivirus software?
A: A firewall operates at the network layer, acting as a "gatekeeper" – controlling what traffic can enter and exit the network, preventing external attackers from breaching the network. Antivirus software works at the host layer, acting as a "scanner" – detecting and removing malware that has already entered the system. They are complementary: firewalls prevent intrusions, while antivirus protects against viruses.
FW-004 Q: What is the difference between a hardware firewall and a software firewall?
A: A hardware firewall is a dedicated physical device with high performance and strong stability, suitable for enterprise deployment. A software firewall is software running on a general-purpose operating system (e.g., Windows Firewall, iptables), offering low cost and high flexibility, suitable for personal or virtualized environments. Hardware firewalls have higher throughput, while software firewalls are more flexible.
FW-005 Q: What is a Next-Generation Firewall (NGFW)?
A: A Next-Generation Firewall (NGFW) adds advanced features to traditional firewalls, such as application identification, Intrusion Prevention System (IPS), and threat intelligence integration. It can identify application-layer protocols (e.g., distinguishing whether HTTP traffic is from WeChat or Douyin), rather than just looking at IP addresses and ports.
FW-006 Q: What is a cloud firewall?
A: A cloud firewall is a firewall service deployed in cloud environments, typically provided as SaaS. It protects cloud assets (such as cloud servers and VPC networks), supports elastic scaling, pay-as-you-go pricing, and is natively integrated with the cloud platform. Cloud firewalls do not consume on-premise hardware resources and are suitable for cloud-native architectures.
FW-007 Q: What is a Web Application Firewall (WAF)?
A: A Web Application Firewall (WAF) is a firewall specifically designed to protect web application security, operating at the application layer (Layer 7). It can identify web attacks such as SQL injection, Cross-Site Scripting (XSS), and CSRF, protecting websites from hacking. WAF is typically deployed in front of web servers.
FW-008 Q: What is the "default deny" principle of a firewall?
A: The "default deny" principle is a core security principle in firewall configuration – unless explicitly allowed, all traffic is denied by default. Unlike "default allow," the default deny principle greatly reduces the attack surface by opening only ports and services essential for business and blocking everything else.
FW-009 Q: How to choose a firewall?
A: Selection considerations:
Performance: Whether throughput, concurrent connections, and new connections per second meet business needs;
Features: Whether advanced functions such as IPS, application identification, and VPN are required;
Deployment scenario: Hardware for perimeter firewalls, cloud firewall for cloud environments;
Brand: Huawei, Sangfor, Hillstone, etc.;
Budget: Ranging from a few thousand to hundreds of thousands of CNY. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for enterprise-grade firewall hardware platforms, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
FW-010 Q: What firewall is recommended for small and medium-sized enterprises (SMEs)?
A: For SMEs, integrated UTM devices or entry-level NGFWs are recommended, such as Huawei USG series, Sangfor AF series, Hillstone SG series, etc. These devices integrate firewall, IPS, antivirus, VPN, and other functions in one box, offering high cost-effectiveness. Budget approximately 5,000-30,000 CNY. In practice, Changfan IPC can evaluate interfaces, power consumption, temperature, and expansion needs for enterprise-grade firewall hardware platforms based on actual scenarios; it is recommended to confirm software compatibility before finalizing the configuration.
FW-011 Q: Is a dedicated home firewall necessary?
A: For ordinary home users, the firewall features built into the optical modem or router are sufficient. Unless there are special needs (such as exposing NAS services to the internet with a public IP and open ports), a separate hardware firewall is not necessary. For purchasing enterprise-grade firewall hardware platforms, Changfan IPC can provide configuration verification, sample testing, and project customization support; pricing and delivery timelines are subject to current quotations and contract terms.
FW-012 Q: What is the approximate price of a firewall?
A:
Entry-level (SOHO/home): 500-2,000 CNY;
SME-grade: 5,000-50,000 CNY;
Mid-to-large enterprise-grade: 50,000-500,000 CNY;
High-end data center-grade: 500,000 to several million CNY. Specific prices depend on throughput, concurrent connections, feature modules, and brand. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for enterprise-grade firewall hardware platforms, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
FW-013 Q: What are the firewall brands?
A: International brands: Palo Alto Networks, Fortinet, Cisco, Check Point, Juniper; Domestic brands: Huawei, Sangfor, Hillstone, Topsec, NSFOCUS, QiAnXin, H3C. Government and enterprise customers should prioritize domestic brands to meet compliance requirements. In practice, Changfan IPC can evaluate interfaces, power consumption, temperature, and expansion needs for enterprise-grade firewall hardware platforms based on actual scenarios; it is recommended to confirm software compatibility before finalizing the configuration.
FW-014 Q: What are the deployment modes of a firewall?
A: Firewalls have two main deployment modes:
Routing mode: The firewall acts as a Layer 3 gateway, connecting different network segments and performing routing and NAT functions;
Transparent mode: The firewall operates at Layer 2 like a "network cable," without changing the network topology, plug-and-play. Bypass mode (mirroring analysis without blocking) is also a special deployment method.
FW-015 Q: Is a firewall deployed in front of or behind the router?
A: Typically deployed behind the router and in front of the core switch. Typical topology: Internet → Router → Firewall → Core Switch → Internal servers/endpoints. The firewall handles security filtering, while the router handles routing and forwarding.
FW-016 Q: How to configure firewall high availability (HA)?
A: High availability (HA) uses two firewalls to form an active-standby cluster, with one active and one standby. When the active device fails, the standby device automatically takes over with millisecond-level switching. Common modes include A/S (active-standby) and A/A (load balancing).
FW-017 Q: What is a security zone on a firewall?
A: A security zone is a logical partition on a firewall used to divide the network into different security levels. Common zones: Untrust (external, low security), Trust (internal, high security), DMZ (demilitarized zone, for public-facing servers). Traffic between different zones is controlled by security policies.
FW-018 Q: How to configure firewall security policies?
A: Security policy configuration follows the "first match, first execute" principle. Configuration steps:
Define source/destination security zones;
Define source/destination IP addresses;
Define services (ports/protocols);
Define actions (allow/deny);
Configure policy order, placing precise rules before broad rules.
FW-019 Q: How to configure NAT on a firewall?
A: NAT configuration typically includes:
Source NAT (SNAT): When internal networks access the external network, private IPs are translated to public IPs;
Destination NAT (DNAT): When external networks access internal services, public IP+ports are mapped to internal server IP+ports. Configure by specifying the IPs and ports before and after translation.
FW-020 Q: How to open ports on a firewall?
A: Steps to open ports:
Create a security policy allowing external access to specific ports;
Configure Destination NAT (DNAT) to map public IP:port to internal server IP:port;
Check policy order to ensure allow rules are placed before deny rules.
FW-021 Q: How to set up whitelists and blacklists on a firewall?
A: Whitelist: Only IPs/users on the list are allowed access; all others are denied – high security but low flexibility. Blacklist: IPs/users on the list are blocked; all others are allowed – easy to operate but lower security. Typically define IP lists in address objects and then reference them in security policies.
FW-022 Q: How to use the Intrusion Prevention System (IPS) function of a firewall?
A: After enabling IPS, the firewall detects attack signatures in traffic in real time (such as SQL injection, brute-force attacks, vulnerability exploits) and can perform actions like blocking, alerting, or resetting connections. Recommendation: Start with "Alert" mode for one week, and switch to "Block" mode after confirming no false positives.
FW-023 Q: What is the use of application identification on a firewall?
A: Application identification enables the firewall to recognize specific applications (such as WeChat, DingTalk, Douyin, BT downloads), rather than just IP addresses and ports. You can implement fine-grained control over specific applications, such as "allow WeChat but prohibit file transfers" or "prohibit P2P downloads during working hours."
FW-024 Q: What if a firewall allows a port but business is still inaccessible?
A: Troubleshooting steps:
Check policy order – whether an earlier deny policy overrides the allow policy;
Check NAT configuration for correctness;
Check whether the server's local firewall has opened the corresponding port;
Check if the route is reachable;
View the firewall session table to confirm whether traffic matches the correct policy.
FW-025 Q: How to troubleshoot network lag/high latency caused by a firewall?
A:
Check if CPU/memory usage on the firewall is too high;
Check if concurrent connections are near the device limit;
Check if too many deep inspection features (IPS, antivirus) are enabled; try temporarily disabling them for testing;
Check for loops or broadcast storms;
Check logs for abnormal traffic.
FW-026 Q: What if a firewall mistakenly blocks legitimate business traffic?
A:
Check firewall logs to identify the blocked traffic characteristics (source IP, destination IP, port, application);
Add an allow policy to precisely allow that business traffic;
If it is an IPS false positive, configure an IPS whitelist for that source IP;
Regularly update the signature database to reduce false positives.
FW-027 Q: What if the firewall session table is full?
A: A full session table is usually caused by:
An infected device in the internal network generating many abnormal connections;
P2P downloads consuming a large number of connections;
Insufficient firewall performance. Solutions:
Identify the source of abnormal traffic;
Adjust session timeout settings to accelerate aging;
Upgrade the device or increase session table capacity.
FW-028 Q: What if the firewall cannot access the internet?
A:
Check connectivity between the firewall and router;
Check if NAT policies are configured correctly;
Check if security policies allow internal-to-external traffic;
Check if the routing table is correct;
Temporarily set the firewall to "allow all" to test if it is a policy issue.
FW-029 Q: What if the firewall VPN connection fails?
A:
Check if VPN configurations (pre-shared key, authentication method) match;
Check if the firewall allows VPN ports (e.g., UDP 500/4500 for IPSec);
Check if NAT traversal is enabled;
Check if routes on both ends are reachable;
Check VPN logs for specific error messages.
FW-030 Q: What is the difference between IPSec VPN and SSL VPN on a firewall?
A: IPSec VPN is suitable for site-to-site interconnection, establishing a network-layer tunnel to connect networks on both ends. SSL VPN is suitable for remote user access via browser or client, without requiring dedicated client software. SSL VPN is more suitable for mobile office scenarios.
FW-031 Q: How to view and analyze firewall logs?
A: Firewall logs include traffic logs, security logs, and system logs. Viewing methods:
View real-time logs through the web management interface;
Configure a Syslog server for centralized storage and analysis;
Use a security analysis platform (e.g., Huawei SecoManager) for correlation analysis. Logs should be retained for at least 6 months to meet compliance requirements.
FW-032 Q: How to back up and restore firewall configurations?
A:
Export the configuration file (usually .conf or .xml format) via the web management interface;
Save it locally or to a remote server;
To restore, upload the backup file through the same interface;
Some devices support scheduled automatic backups to FTP/SFTP servers. Always back up configurations before upgrading firmware.
FW-033 Q: How to upgrade firewall firmware?
A:
Download the latest firmware for the model from the vendor's official website;
Upload the firmware file through the web management interface;
Do not power off during the upgrade;
Reboot the device after the upgrade is complete;
Verify that security policies are functioning properly. Always back up the current configuration before upgrading.
FW-034 Q: What if the firewall password is forgotten?
A:
Try the default password (e.g., admin/admin; check the manual for specifics);
Some devices support password recovery via the console port;
Contact the vendor's technical support or local distributor for assistance.
FW-035 Q: What routine inspections should be performed on a firewall?
A: Recommended weekly inspections:
CPU/memory/session table utilization;
Whether firmware and signature databases are up to date;
Whether logs show abnormal alerts;
Device temperature and fan status;
Whether policy rules have redundant or expired entries.
FW-036 Q: How to protect a firewall from attacks?
A:
Enable DDoS protection;
Configure blacklists to block known malicious IPs;
Regularly update IPS signature databases;
Close unnecessary ports and services;
Allow management ports (e.g., WEB/SSH) only from specific IPs;
Enable two-factor authentication (if supported).
FW-037 Q: What is an Access Control List (ACL) on a firewall?
A: ACL (Access Control List) is a core component of a firewall, consisting of a series of rules. Each rule defines matching conditions (source IP, destination IP, port, etc.) and an action (allow/deny). ACLs are matched in order, with the first matching rule taking effect.
FW-038 Q: What are the default administrator credentials for firewalls?
A: Default credentials vary by brand: Huawei USG series default admin/Admin@123; Sangfor AF series default admin/admin; Hillstone default hillstone/hillstone. Important: Always change the default password upon first use – this is a basic security requirement.
FW-039 Q: How to deploy a firewall in a data center?
A: Firewalls in data centers are typically deployed at north-south traffic entry points (internet access) and east-west traffic paths (between different business zones). Common deployment schemes:
Perimeter firewall protects the entire data center;
Zonal firewalls isolate different security zones (e.g., web zone, database zone);
Virtual firewalls (vFW) protect cloud tenants. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for enterprise-grade firewall hardware platforms, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
FW-040 Q: How to deploy a firewall in a cloud environment?
A: Cloud firewalls are typically deployed as virtualized instances:
Deploy cloud firewall instances at the VPC boundary of the cloud platform;
Combine security groups with cloud firewalls for defense-in-depth;
Support automatic elastic scaling;
Integrate with the cloud platform's log service for unified security operations. In practice, Changfan IPC can evaluate interfaces, power consumption, temperature, and expansion needs for enterprise-grade firewall hardware platforms based on actual scenarios; it is recommended to confirm software compatibility before finalizing the configuration.
FW-041 Q: How does a firewall meet MLPS compliance requirements?
A: MLPS 2.0 requirements for firewalls:
Must be deployed at network boundaries (regional boundary security);
Must have access control functions (ACL);
Must have intrusion detection/prevention functions (IDS/IPS);
Must have log auditing functions, with logs retained for at least 6 months;
Domestic equipment should be used (for Level 3 MLPS). For purchasing enterprise-grade firewall hardware platforms, Changfan IPC can provide configuration verification, sample testing, and project customization support; pricing and delivery timelines are subject to current quotations and contract terms.
FW-042 Q: How to use a firewall in industrial control (OT) scenarios?
A: When deploying firewalls in OT scenarios (e.g., factories, power grids), note the following:
Use industrial-grade hardware supporting wide temperature ranges and dust resistance;
Support industrial protocol identification (such as Modbus, S7, OPC, etc.);
Avoid deep inspection that affects real-time performance;
Deploy in transparent mode to minimize network impact. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for enterprise-grade firewall hardware platforms, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
FW-043 Q: Does having a firewall guarantee complete security?
A: No. A firewall is only the first line of defense in network security and cannot defend against all threats:
It cannot prevent internal data leaks;
It cannot defend against malicious traffic carried over encrypted channels (like HTTPS) (requires SSL decryption);
It cannot defend against zero-day attacks (requires threat intelligence and sandboxing). Defense-in-depth is the correct approach.
FW-044 Q: Are more firewall rules always safer?
A: Not necessarily. Too many rules can cause problems:
Management chaos, potential conflicting rules leading to protection gaps;
Reduced matching efficiency, affecting firewall performance;
Difficult to audit and optimize. It is recommended to regularly clean up redundant rules and keep the rule set concise and orderly.
FW-045 Q: Does a "permit all" policy on a firewall allow all traffic?
A: Yes, but a "permit all" policy is extremely dangerous – it renders the firewall practically useless. The correct practice is to follow the "default deny" principle and only allow traffic necessary for business. Any overly permissive policy significantly increases security risks.
FW-046 Q: Are open-source firewalls (like pfSense) inferior to commercial firewalls?
A: Not necessarily. Open-source firewalls (like pfSense, OPNsense) are feature-rich and suitable for budget-conscious SMEs and tech enthusiasts. However, commercial firewalls have advantages:
Professional after-sales support;
Fast-response threat intelligence;
Compliance certifications (e.g., MLPS). Both have their applicable scenarios.
FW-047 Q: Is higher firewall throughput always better?
A: Not necessarily. Throughput should match network bandwidth – a 1000M broadband only needs a firewall with 1000M throughput. Excessively high throughput means higher costs and potential budget waste. When selecting, also consider whether concurrent connections and new connections per second meet business needs.
FW-048 Q: What does stateful inspection mean on a firewall?
A: Stateful inspection means that the firewall not only checks individual packets but also tracks the entire connection state (TCP three-way handshake, sequence numbers, etc.). Only return traffic belonging to established connections is allowed, effectively defending against IP spoofing and other attacks. This is a fundamental feature of modern firewalls.
FW-049 Q: What is Deep Packet Inspection (DPI) on a firewall?
A: DPI (Deep Packet Inspection) is a technology where the firewall examines the payload content of packets, not just the headers. Through DPI, the firewall can identify application types (WeChat, BT, video), detect malware, discover data leaks, and more. However, DPI consumes significant CPU resources, requiring a balance between performance and detection.
FW-050 Q: What is UTM on a firewall?
A: UTM (Unified Threat Management) integrates multiple security functions – firewall, IPS, antivirus, anti-spam, VPN, etc. – into a single device. UTM is suitable for SMEs, as one device solves multiple security problems. NGFW is an evolution of UTM, with greater emphasis on application identification and intelligent integration.
FW-051 Q: Can a firewall defend against DDoS attacks?
A: Firewalls can defend against some DDoS attacks (e.g., SYN Flood, ICMP Flood). However, for large-scale DDoS attacks (e.g., hundreds of Gbps of traffic), the firewall itself becomes a bottleneck. Such scenarios require professional DDoS scrubbing devices or cloud-based scrubbing services.
FW-052 Q: How to configure SSL decryption on a firewall?
A: Steps for SSL decryption configuration:
Import a CA certificate onto the firewall;
Configure SSL decryption policies, specifying which traffic to decrypt (e.g., HTTPS);
Have client devices trust the firewall's CA certificate. After SSL decryption, the firewall can inspect encrypted traffic for malicious content. Note: SSL decryption involves privacy concerns and must comply with local laws and regulations.
FW-053 Q: How does a firewall integrate with security situational awareness?
A: The firewall reports security logs and threat alerts to the situational awareness platform. The platform performs correlation analysis and, upon detecting abnormal behavior, issues blocking policies to the firewall, enabling automated security response. This integration is a standard requirement for modern security operations.
FW-054 Q: How does a firewall support a zero-trust architecture?
A: In a zero-trust architecture, the firewall acts as a "policy enforcement point":
No longer trusting the internal network – all traffic requires security inspection;
Applying fine-grained access control based on user identity and device state;
Continuously monitoring and assessing the risk level of each connection, dynamically adjusting permissions.
- Previous article Q&A about IPTV network server
- Next article Q&A about SDWAN products