a) In Figure 4-18, explain why Rule 1 brings more security than Rule 2. b) Explain why the last rule in an ACL should deny anything not previously approved by earlier rules. c) Why do you think authentication is sometimes required before accepting a connection? d) When a packet addressed to 60.1.232.89 arrives, what rule will the SPI firewall look at first? e) Why must Rule 2 come after Rule 1?

Rule Source IP Destination IP Server Port Action on Remark Address Address Number Connection 60.3.47.138 80 Open access to this webserver ANY 80 Allow Open access to any webserver Any Interna 60.1.232.89 80 Authenticate, Open access for internal hosts to this webserver then allow following authentication. Finance Finance Authenticate, Any connection between Finance hosts with then allow Any Intemal 60.44.2.17 25 Allow Open access for internal hosts to this mail server. Any Deny any connection not permitted by a previous ule Figure 4-18 Access Control List (ACL) for a Stateful Inspection Firewall to Apply to Packets Attempting to Create a Connection