Intranet Security via Firewalls

Firewalls, forefront defense for corporate intranet security, filter traffic by comparing arriving packets against stored security policies in a sequential manner. In a large organization, traffic typically goes through several firewalls before it reaches the destination. Setting polices device-by-device in an organization with large number of firewalls may easily create conflicts in policies. The dependency of one firewall on the other in the network hierarchy requires the policies applied to resolve the conflicts to be in a specific order. A certain traffic type may be allowed in a lower-order firewall but blocked by a higher-order device. Also, a conflicts analyzer able to detect conflicts in a single device is not capable of analyzing enterprise-wise policy anomalies. Moreover, most of the existing tools are very much device-specific, whereas today’s organizations operate in a multivendor environment. In this chapter, we first discuss various issues related to policy conflicts in firewalls. We then propose an architecture for an enterprise-wise firewall policy management system that can detect conflict in real time when a new policy is added to any firewall.