Transcompiling Firewalls

Abstract

Porting a policy from a firewall system to another is a difficult and error prone task. Indeed, network administrators have to know in detail the policy meaning, as well as the internals of the firewall systems and of their languages. Equally difficult is policy maintenance and refactoring, e.g., removing useless or redundant rules. In this paper, we present a transcompiling pipeline that automatically tackles both problems: it can be used to port a policy into an equivalent one, when the target firewall language is different from the source one; when the two languages coincide, transcompiling supports policy maintenance and refactoring. Our transcompiler and its correctness are based on a formal intermediate firewall language that we endow with a formal semantics. Work partially supported by CINI Cybersecurity National Laboratory within the project FilieraSicura: Securing the Supply Chain of Domestic Critical Infrastructures from Cyber Attacks (www.filierasicura.it) funded by CISCO Systems Inc. and Leonardo SpA.

Language-Independent Synthesis of Firewall Policies

“…We intend to investigate the problem of compiling an abstract specification into concrete firewall languages along the lines of [36]. This would enable cross-compilation from one firewall system to another, complementing what we presented in this paper.…”

FWunify: uma Ferramenta para Simplificar a Configuração de Múltiplos Firewalls

“…Na prática, instituições como a Unipampa e provedores de Internet regionais sofrem com os problemas e custos operacionais resultantes da configuração de diferentes tipos e versões de firewalls. Apesar de existirem soluções como a IFCL [Bodei et al, 2018], que viabilizam a migração de regras de um tipo de firewall para outro, elas não oferecem recursos para operacionalizar o gerenciamento simultâneo de diferentes soluções.…”