WatchGuard Firebox System 7.0 User Guide

CHAPTER 9Configuring ProxiedServicesProxy filtering goes a step beyond packet filtering byexamining a packet’s content, not just the packet’sheader. Consequently, the proxy determines whether aforbidden content type is hidden or embedded in thedata payload. For example, an email proxy examinesall SMTP packets to determine whether they containforbidden content types, such as executable programsor items written in scripting languages. Such items arecommon methods of transmitting computer viruses.The SMTP proxy knows these content types are notallowed, while a packet filter would not detect theunauthorized content in the packet’s data payload.Proxies work at the application level, while packet filterswork at the network and transport protocol level.In other words, each packet processed by a proxy isstripped of all network wrapping, analyzed,rewrapped, and forwarded to the intended destination.This adds several layers of complexity and processingbeyond the packet filtering process. What thismeans, of course, is that proxies use more processingbandwidth than packet filters. On the other hand, theyUser Guide 135