Method and apparatus for managing a firewall
First Claim
1. A method for generating a configuration file for at least one firewall in a network, said network including a plurality of hosts, said method comprising the steps of:
- receiving a definition for a plurality of roles that specify the ability of a host to send and receive packets, wherein each of said roles may be assigned to said hosts independently of a topology of said network, such that said hosts inherit said definitions associated with an assigned role;
receiving an assignment of said roles to said hosts in said network; and
generating rules for said hosts based on said assigned roles, said rules determining whether a packet is passed to a destination host.
2 Assignments
0 Petitions
Accused Products
Abstract
A method and apparatus are disclosed for managing a firewall. The disclosed firewall manager facilitates the generation of a security policy for a particular network environment, and automatically generates the firewall-specific configuration files from the security policy simultaneously for multiple gateways. The security policy is separated from the vendor-specific rule syntax and semantics and from the actual network topology. Thus, the security administrator can focus on designing an appropriate policy without worrying about firewall rule complexity, rule ordering, and other low-level configuration issues. In addition, the administrator can maintain a consistent policy in the presence of intranet topology changes. The disclosed firewall manager utilizes a model definition language (MDL) and an associated parser to produce an entity relationship model. A model compiler translates the entity-relationship model into the appropriate firewall configuration files. The entity-relationship model provides a framework for representing both the firewall-independent security policy, and the network topology. The security policy is expressed in terms of “roles,” which are used to define network capabilities of sending and receiving services. A role may be assumed by different hosts or host-groups in the network. A visualization and debugging tool is provided to transform the firewall-specific configuration files into a graphical representation of the current policy on the actual topology, allowing the viability of a chosen policy to be evaluated. A role-group may be closed to prevent the inheritance of roles.
-
Citations
16 Claims
-
1. A method for generating a configuration file for at least one firewall in a network, said network including a plurality of hosts, said method comprising the steps of:
-
receiving a definition for a plurality of roles that specify the ability of a host to send and receive packets, wherein each of said roles may be assigned to said hosts independently of a topology of said network, such that said hosts inherit said definitions associated with an assigned role; receiving an assignment of said roles to said hosts in said network; and generating rules for said hosts based on said assigned roles, said rules determining whether a packet is passed to a destination host. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. A method of generating a security policy for a network, said network including a plurality of hosts, said method comprising the steps of:
-
receiving a definition for a plurality of roles that specify the ability of a host to send and receive packets, wherein each of said roles may be assigned to said hosts independently of a topology of said network, such that said hosts inherit said definitions associated with an assigned role; receiving an assignment of said roles to said hosts in said network; and generating said security policy from said received definitions and assignments. - View Dependent Claims (10, 11, 12, 13, 14)
-
-
15. A compiler for generating a configuration file for a firewall in a network, said network including a plurality of hosts, comprising:
-
a memory for storing computer-readable code; and a processor operatively coupled to said memory, said processor configured to execute said computer-readable code, said computer-readable code configuring said processor to; receive a definition for a plurality of roles that specify the ability of a host to send and receive packets, wherein each of said roles may be assigned to said hosts independently of a topology of said network, such that said hosts inherit said definitions associated with an assigned role; receive an assignment of said roles to said hosts in said network; and generate rules for said hosts based on said assigned roles, said rules determining whether a packet is passed to a destination host.
-
-
16. A system for generating a security policy for a network, said network including a plurality of hosts, said system comprising:
-
a memory for storing computer-readable code; and a processor operatively coupled to said memory, said processor configured to execute said computer-readable code, said computer-readable code configuring said processor to; receive a definition for a plurality of roles that specify the ability of a host to send and receive packets, wherein each of said roles may be assigned to said hosts independently of a topology of said network, such that said hosts inherit said definitions associated with an assigned role; receive an assignment of roles to said hosts in said network; and
generate said security policy from said received definitions and assignments.
-
Specification