SP 800-41 Rev. 1Final2009

Guidelines on Firewalls and Firewall Policy

At a glanceExplains firewall types, what each can and cannot do, and how to write and maintain a firewall policy. It dates from 2009, so product details are old, but the policy principles (deny by default, documented rules, testing) still hold.

Reading level: Technical
Length: 48 pages · about 30 min for the key parts
Best for: IT staff and service partners
CSF 2.0: Protect

Read it on NIST DOI 10.6028/NIST.SP.800-41r1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The guide covers packet filtering, stateful inspection, application firewalls, proxies and host firewalls, how firewalls fit network architectures, how to build a firewall policy and how to plan, configure, test, deploy and manage firewalls.

How it is organized

Firewall technologies
Firewalls and network architectures
Firewall policy
Planning and implementation: plan, configure, test, deploy, manage

What a school district should take from it

Every allowed rule should have an owner and a reason; review rules at least yearly.
Host firewalls on laptops add protection when devices leave the building.

How to use it in your district

Export the firewall rule set and remove rules nobody can explain.
Default to deny for inbound traffic and document exceptions.
Schedule a yearly rule review in the operations planner.

Common misconceptions

A 2009 guide is irrelevant.: Specific technologies have changed, but the policy and review practices it describes are still sound.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

PR.IRTechnology Infrastructure Resilience
PR.PSPlatform Security

Tools in the program portal

School-year operations plannerSchedule recurring security work across the year
District operations toolkitLocal scripts for inventory and configuration checks

Related publications

SP 800-215Modern network security landscape

Citation and source

SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy. National Institute of Standards and Technology. 2009. https://doi.org/10.6028/NIST.SP.800-41r1.

Replaces: SP 800-41 (2002).

Topics: Network security. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.