Firewall Design: Understandable, Designable and Testable

Firewalls are the cornerstones of network security. To make firewalls working effectively, firewall manager must design firewall rules and the rule order correctly. In this paper, we present a firewall management toolkit which makes firewall rules understandable, designable and testable. Understandable means that the rules shown to the manager are easily understood. Designable means that it is no need to design the rule order when modifying the firewall rules. Testable means that firewall rules can be tested without other device. Our method is based on security policy diagram(SPD, for short). We then apply a sequence of algorithms to generate corresponding firewall policy from SPD to be understood, designed and tested. The firewall management toolkit significantly simplifies the management of any generic firewall policy written as filtering rules.