Network Perimeter Security
Components and placement
Perimeter defense is built from firewalls, DMZs, ACLs, NAT, proxies, VPN gateways, IDS/IPS, honeypots, and bastion hosts. Firewall generations matter: packet-filtering (stateless, header-only), stateful inspection (tracks connection state), application proxy (breaks the client-server connection, deep inspection, slower), and NGFW (application identification, user awareness, IPS integration). A DMZ holds internet-facing services so that a compromised web server is not adjacent to the internal database.
Rules are evaluated top-down, first match wins, with an implicit deny at the end, so specific rules must sit above general ones. On a router, an inbound ACL filters traffic entering an interface and an outbound ACL filters traffic leaving it - putting a standard ACL too close to the source may block legitimate transit traffic.
Traps
IDS versus IPS placement is the classic trap: an IDS is passive, fed by a SPAN port or TAP, and cannot block; an IPS sits inline and can drop. NAT questions hinge on static (one-to-one), dynamic (pool), and PAT/overloading (many-to-one). Watch for the difference between a screened subnet and a true DMZ, and remember that a honeypot is a detective/deception control, not a preventive one.
Rule of thumb
Design order: default-deny, then allow only what a documented business flow needs, place the control as close to the resource as practical, and log everything the rule set denies. If asked where to put an IPS for a public web farm, the answer is inline in front of the DMZ segment, not on the internal core.