Firewalls

Synonyms

Consistency verification of security policy; Firewall policy analysis; IPSec policy analysis

Definition

A network access control list or ACL, $\mathcal{P}$, is a set of ordered rules, ${\mathcal{R}}_{i}$, the defines the transformation actions, ${\mathcal{A}}_{i}$, (e.g., such as accept or deny in firewalls, and ESP for encryption and AH for authenticate in IPSec) that are performed on matched traffic flows, ${\mathcal{C}}_{i}$, defined using header information. A conflict exists in ACL policies if there are two (or more) different rules (${\mathcal{R}}_{i}$ and ${\mathcal{R}}_{j}$) that match the same traffic flow partially or complectly (i.e., ${\mathcal{C}}_{i} \bigcap \nolimits {\mathcal{C}}_{j}\neq \emptyset$). If the two rules existing in the same firewall or IPSec device, it is called intra-policy conflict. However, if they exist in two different devices across the network, it is called intra-policy conflict.

Background

Complexity of Managing Network...