Authors Marcus Goncalves and Steven Brown--Goncalves has a particularly strong reputation as a firewall guru--describe sound practices for formulating security policies, then implementing those policies as FireWall-1 rules. Coverage focuses on Windows NT installations of FireWall-1. Unix gets some attention, but practically all the screen shots show a Microsoft operating system.

The most interesting parts of this book have to do with how FireWall-1 identifies and reacts to specific kinds of attacks. For example, the authors explain how the FireWall-1 INSPECT engine, faced with attempts to overwhelm a protected machine with unresolved connection attempts (a SYN flood), can use SYNDefender Relay or SYNDefender Gateway to intercept or monitor requests and acknowledgments. They typically map packet exchanges with simple but effective transmission diagrams consisting of ASCII characters. The coverage of VPNs involving mobile users and their implementation with SecuRemote also is strong. --David Wall