Special Publication 800-41 
                                               Revision 1 
            Guidelines on Firewalls and 
            Firewall Policy 
            Recommendations of the National Institute 
            of Standards and Technology 
             
            Karen Scarfone 
            Paul Hoffman 
             
             
                    
                  NIST Special Publication 800-41       Guidelines on Firewalls and Firewall 
                  Revision 1                            Policy 
                                                         
                                                        Recommendations of the National  
                                                        Institute of Standards and Technology 
                                                         
                                                        Karen Scarfone 
                                                        Paul Hoffman 
                      C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y
                                                        Computer Security Division 
                                                        Information Technology Laboratory 
                                                        National Institute of Standards and Technology 
                                                        Gaithersburg, MD 20899-8930 
                                                         
                                                        September 2009 
                                                         
                                                         
                                                         
                                                                        
                                                         U.S. Department of Commerce 
                                                                Gary Locke, Secretary 
                                                         National Institute of Standards and Technology 
                                                                Patrick D. Gallagher, Deputy Director 
                                        GUIDELINES ON FIREWALLS AND FIREWALL POLICY 
                                   
                     Reports on Computer Systems Technology 
                                   
        The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology 
        (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s 
        measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of 
        concept implementations, and technical analysis to advance the development and productive use of 
        information technology. ITL’s responsibilities include the development of technical, physical, 
        administrative, and management standards and guidelines for the cost-effective security and privacy of 
        sensitive unclassified information in Federal computer systems. This Special Publication 800-series 
        reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative 
        activities with industry, government, and academic organizations. 
         
                                   
              National Institute of Standards and Technology Special Publication 800-41 Revision 1 
                  Natl. Inst. Stand. Technol. Spec. Publ. 800-41 rev1, 48 pages (Sep. 2009) 
                                   
                                    
                                   
                                   
         
                                   
                 Certain commercial entities, equipment, or materials may be identified in this 
                 document in order to describe an experimental procedure or concept adequately.  
                                   
                Such identification is not intended to imply recommendation or endorsement by the 
                                   
                National Institute of Standards and Technology, nor is it intended to imply that the 
                entities, materials, or equipment are necessarily the best available for the purpose. 
                                   
                                   
                                   
                                   
                                  iii
                                               GUIDELINES ON FIREWALLS AND FIREWALL POLICY 
                                Acknowledgments 
           
          The authors, Karen Scarfone of the National Institute of Standards and Technology (NIST) and Paul 
          Hoffman of the Virtual Private Network Consortium, wish to thank their colleagues who reviewed drafts 
          of this document and contributed to its technical content. The authors would like to acknowledge Tim 
          Grance, Murugiah Souppaya, Sheila Frankel, and Gale Richter of NIST, and Matthew Goche, David 
          Klug, Logan Lodge, John Pearce, Noel Richards, Anne Roudabush, and Steven Sharma of Booz Allen 
          Hamilton, for their keen and insightful assistance throughout the development of the document. Special 
          thanks go to Brahim Asfahani of Booz Allen Hamilton for his contributions to early drafts of the 
          document. The authors also thank all the reviewers who provided feedback during the public comment 
          period, particularly Joel Snyder (Opus One), Ron Colvin (National Aeronautics and Space Administration 
          [NASA]), Dean Farrington (Wells Fargo), Raffael Marty (Splunk), and David Newman (Network Test). 
          The authors also wish to express their thanks to the individuals and organizations that contributed to the 
          original version of the publication, including John Wack of NIST and Ken Cutler and Jamie Pole of the 
          MIS Training Institute, who authored the original version, and other contributors and reviewers—
          particularly Peter Batista and Wayne Bavry (U.S. Treasury); Harriet Feldman (Integrated Computer 
          Engineering, Inc.); Rex Sanders (U.S. Geological Survey); and Timothy Grance, D. Richard Kuhn, Peter 
          Mell, Gale Richter, and Murugiah Souppaya (NIST).  
           
                                         
                                       iv