At which layer does a firewall operate? What about a load balancer, a wireless AP and a layer 3 switch?
Show the answer
Say this first
A classic stateful firewall decides at layers 3 and 4: addresses, protocol, ports and connection state. A next generation firewall reads up to layer 7 to identify applications, users and threats. It can sit in routed mode as a layer 3 hop, or in transparent mode as a layer 2 bridge. An L4 load balancer works on IP and ports; an L7 one reads HTTP. An AP bridges 802.11 to 802.3 at layer 2. A layer 3 switch switches at layer 2 and routes at layer 3 in hardware.
Go deeper
Two different questions hide here
- Where does it sit in the path? Routed firewall: it is the next hop, has IPs on each side, routes. Transparent firewall: it bridges between two VLANs on the same subnet and is invisible to traceroute.
- How deep does it look? Packet filter (stateless ACL): layers 3 and 4, each packet on its own. Stateful firewall: layers 3 and 4 plus a connection table, so return traffic is allowed automatically. NGFW: application identification, URL filtering, IPS, TLS inspection, user identity. That is layer 7.
Other devices
| Device | Forwards on | Notes |
|---|---|---|
| Wireless AP | Layer 2 | Translates 802.11 frames to 802.3. In controller designs, data may be tunneled in CAPWAP. |
| L4 load balancer | IP and port | Can do NAT, often DSR, does not read the payload. |
| L7 load balancer | HTTP host, path, headers, cookies | Terminates TCP and usually TLS, opens a new connection to the server. |
| Layer 3 switch | MAC within a VLAN, IP between VLANs | SVIs or routed ports, routing in ASIC. |
| NIC | Layers 1 and 2 | Has the MAC, does framing and FCS. |
They will ask next
Why might you deploy a firewall in transparent mode?
To insert it into an existing network without re-addressing. The subnet stays the same on both sides, the default gateway does not change, and the firewall still filters traffic between the two segments.
Does a stateless ACL on a router make it a firewall?
It filters, but without state it cannot know that an inbound packet belongs to a connection the inside opened. You end up permitting broad return traffic, for example by the
establishedkeyword, which only checks for ACK or RST bits.
Traps
- Saying "a firewall is layer 4" without separating placement (routed or transparent) from inspection depth.