With the development of enterprise Intranet and cluster servers, many emerging security challenges could not be solved by conventional firewall due to its inner deficiency. To address these security problems, we present a mobile-agent based distributed dynamic ?Firewall architecture. In this architecture, special mobile agents implement dynamic security policy reconfiguration and enhance the scalability. Each ?Firewall is built with a packet filter and DTE-enhanced evaluator to provide dual fine-grain protection at the individual host level. A distributed intrusion detection and response (DIDR) system provides fast response to both external and internal attacks, and allows adaptive change in security policy in the protected network. DIDR system provides the infrastructure to support hierarchical intrusion response and dynamic security capabilities. The distributed security architecture is scalable, topology independent, and intrusion-tolerant.