Abstract
For the security consistency, firewall rule editing, ordering, and distribution must be done very carefully on each of the cooperative firewalls, especially in a large-scale and multi-firewall-equipped network. Nevertheless, a network operator is prone to incorrectly configuring the firewalls because there are typically thousands or hundreds of filtering/admission rules (i.e., rules in the Access Control List file; or ACL for short) which should be setup in a firewall, not mention these rules among firewalls which affect mutually can make the matter worse. For this reason, our work is to build a visualized validation system for checking the security consistency between firewalls’ rule configuration and the demands of network security policies. The system collects the filtering/admission rules (or ACL rules) from all of the firewalls (and routers if they are ACL-configured) in the managed network and then checks if these rules meet the demands of the global network security policies. The checked/analyzed results would later be visualized systematically by our system with different viewpoints for error debugging or anomaly removal. Currently, part of the firewalls’ configuration of our campus network has being used to demonstrate our system’s implementation.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Ioannidis, S., Keromytis, A., Bellovin, S., Smith, J.M.: Implementing a Distributed Firewall. In: ACM Computer and Communication Security, pp. 190–199. ACM Press, New York (2000)
Eppstein, D., Muthukrishnan, S.: Internet Packet Filter Management and Rectangle Geometry. In: 12th Annual ACM-SIAM Symposium on Discrete Algorithms, pp. 827–835. ACM Press, New York (2001)
Hari, B., Suri, S., Parulkar, G.: Detecting and Resolving Packet Filter Conflicts. In: IEEE INFOCOM, vol. 3, pp. 1203–1212. IEEE Press, New York (2000)
Guttman, J.D.: Filtering Postures – Local Enforcement for Global Policies. In: IEEE Symposium on Security and Privacy, pp. 120–129. IEEE Press, New York (1997)
Chen, I.D.: An Internet Firewall Policy Validation System. Feng Chia University, Taiwan (2006)
Al-Shaer, E., Hamed, H.: Discovery of Policy Anomalies in Distributed Firewalls. In: 23rd Annual Joint Conference of the IEEE Computer and Communications Societies, vol. 4, pp. 2605–2616. IEEE Press, New York (2004)
Al-Shaer, E., Hamed, H.: Firewall Policy Advisor for Anomaly Discovery and Rule Editing. In: 8th International Symposium on Integrated Network Management, pp. 17–30. IEEE Press, New York (2003)
Al-Shaer, E., Hamed, H., Boutaba, R., Hasan, M.: Conflict Classification and Analysis of Distributed Firewall Policies. IEEE J. on Selected Areas in Communications 23(10), 2069–2084 (2005)
Al-Shaer, E.: Managing Firewall and Network-edge Security Policies. In: IEEE Network Operations and Management Symposium, vol. 1, pp. 926–932. IEEE Press, New York (2004)
Bartal, Y., Mayer, A.J., Nissim, K., Wool, A.: Firmato: A Novel Firewall Management Toolkit. ACM Transactions on Computer Systems 22, 381–420 (2004)
Bartal, Y., Mayer, A.J., Nissim, K., Wool, A.: Firmato: A Novel Firewall Management Toolkit. In: 20th IEEE Symposium on Security and Privacy, pp. 17–31. ACM Press, New York (1999)
Kurose, J.F., Ross, K.W.: Computer Networking: A Top-Down Approach Featuring the Internet, 3rd edn. Ch. 8, Security in Computer Networks. Addison Wesley, New York (2005)
Author information
Authors and Affiliations
Editor information
Rights and permissions
Copyright information
© 2007 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Chao, CS. (2007). A Visualized Internet Firewall Rule Validation System. In: Ata, S., Hong, C.S. (eds) Managing Next Generation Networks and Services. APNOMS 2007. Lecture Notes in Computer Science, vol 4773. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-75476-3_37
Download citation
DOI: https://doi.org/10.1007/978-3-540-75476-3_37
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-75475-6
Online ISBN: 978-3-540-75476-3
eBook Packages: Computer ScienceComputer Science (R0)