Building Internet Firewalls, 2nd Edition

Chapter 26. Maintaining Firewalls

If you’ve done a good job of designing a firewall that fits the needs of your organization, maintaining that firewall should be fairly straightforward. What does it mean to maintain a firewall? Maintenance tasks fall into three major categories:

• Housekeeping

• Monitoring your system

• Keeping up to date

Once you’ve designed and built your firewall, it really shouldn’t take a great deal of effort to keep it going, especially because much of the maintenance work can be automated.

Housekeeping

Housekeeping is the eternal round of small tasks that need to be done to keep your firewall clean and safe. There are three main tasks you’ll need to deal with again and again:

• Backing up your firewall

• Managing your accounts

• Managing your disk space

Backing Up Your Firewall

Make sure to back up all parts of your firewall. That means not only the general-purpose computers you may be using as bastion hosts or internal servers, but also the routers or other special-purpose devices. Rebuilding router configurations usually isn’t easy, and your security depends on having your routers configured correctly.

Put your general-purpose machines on a regular, automated backup system. Preferably, that system should produce confirmation mail when it is running normally and distinctly different messages when it sees errors.

Why not produce mail only when errors occur? If the system produces mail only on errors, you won’t notice the system if it fails to run at all. (Silence is not necessarily ...