Security 7-15Design guidelinesCareful thought should go into designing a new filter set. You shouldconsider the following guidelines:n Be sure the filter set’s overall purpose is clear from thebeginning. A vague purpose can lead to a faulty set, and thatcan actually make your networkless secure.n Be sure each individual filter’s purpose is clear.n Determine how filter priority will affect the set’s actions. Testthe set (on paper) by determining how the filters would respondto a number of different hypothetical packets.n Consider the combined effect of the filters. If every filter in aset fails to match on a particular packet, the packet is:n passed if all the filters are configured to discard (not for-ward).n discarded if all the filters are configured to pass (forward).n discarded if the set contains a combination of pass anddiscard filters.Disadvantages of filtersAlthough using filter sets can greatly enhance network security,there are disadvantages:n Filters are complex. Combining them in filter sets introducessubtle interactions, increasing the likelihood of implementationerrors.n Enabling a large number of filters can have a negative impacton performance. Processing of packets will take longer if theyhave to go through many checkpoints.
