A new FDD-based method for distributed firewall misconfigurations resolution

Abstract

Firewall is one of the most commonly used techniques to protect a network, it limits or provides access to specific network segments based on a set of filtering rules that should be configured with respect to the global security policy. Nevertheless, the security policy (SP) changes frequently due to business or application needs, and this change often impact firewall configurations by generating new conflicts between different rules. Therefore, discovering and removing automatically the configuration errors is a serious and an unavoidable task. This problem has been addressed through a variety of approaches from firewalls rules analysis to firewall configuration verification, but existent solutions have, essentially, three drawbacks: First, most of them did not analyze all relations between all rules in such a way, some classes of configuration errors could be uncharted. Second, the distinction between syntactic intentional anomalies and effective misconfigurations is not generally highlighted. Third, although anomalies resolution is a tedious and error prone task, it is generally done manually by the network administrator. In this paper, we address this problem using a data structure (FDD: Firewall Decision Diagram). We propose a new approach to detect and correct automatically misconfigurations in a distributed environment. We demonstrate the applicability and scalability of our method by the use of a Satisfiability Solver. The first results we obtained are very promising.