Firewalls are core elements in network security. However, managing firewall rules, especially for enterprize networks, has become complex and error-prone. Firewall filtering rules have to be carefully written and organized in order to correctly implement the security policy. In addition, inserting or modifying a filtering rule requires thorough analysis of the relationship between this rule and...

Firewalls are notoriously hard to configure and maintain. Policies are written in lowlevel, system-specific languages where rules are inspected and enforced along non-trivial control flow paths. Moreover, firewalls are tightly related to Network Address Translation (NAT) since filters need to be specified taking into account the possible translations of packet addresses, further complicating th...

Kurzfassung Im Rahmen einer umfassenden Security-Policy stellen Firewall-Systeme eine wichtige Maßnahme zum Schutz eines privaten Netzes vor Angriffen aus dem Internet dar. Durch die Einführung neuer Applikationstypen, zu denen auch IP-Telefonie Applikationen gehören, ergeben sich neue Anforderungen denen ein Firewall-System gerecht werden muß. Diesen neuen Anforderungen werden existierende Fir...

The paper presents a new formalization for firewall systems, called the Unified Firewall Model (UFM). It offers an abstraction over firewall implementations, and uses formal concepts of Rule-Based Systems to describe firewall syntax and semantics. It is backed by the XTT/ARD design methods. It allows for improving system quality, by introducing a formal verification during the design stage.

Firewalls offer a protection for private networks against external attacks. However, Configuring firewalls is a difficult task. The reason in that the effects of a firewall configuration cannot be easily seen during the configuration time. As a result, errors and loopholes in firewall configurations, if exist are discovered only after they actually happen at the execution time. In this paper, w...

A function-parallel network firewall is a scalable architecture that consists of multiple firewalls. Rules are distributed across the array such that each firewall implements a portion of the original policy. This resutls in significantly lower delays than other parallel designs; however, the design requires firewall intercommunication to coordinate the array which is difficult to implement and...

This paper commences by explaining some firewall definitions in order to understand basic terms for firewall techniques. Three firewall techniques, from packet filtering through to proxy services and stateful packet inspection are then discussed. Following techniques, various firewall architectures, ranging from dual-home host architecture, screened host architecture and screened subnet archite...

A firewall administrator often needs to update a given firewall, to take account of evolving security requirements or to correct a wrongly classified packet. We look at the problem of firewall update, mainly from an axiomatic viewpoint. An axiom for firewall update is a property which any reasonable method of updating should fulfill. We propose a number of such axioms. We also give some simple ...

Firewalls are one of the most common mechanisms used to protect the network from unauthorized access and security threats. Nowadays, time-based firewall policies are widely in use in many firewalls such as CISCO ACLs and Linux iptables to control network traffic with respect to time. However, network administrators struggle to maintain the firewall policies due to their high complexity. A confl...