An Automated Framework for Validating Firewall Policy Enforcement

摘要: The implementation of network security devices such as firewalls and IDSs are constantly being improved to accommodate higher performance standards. Using reliable yet practical techniques for testing the functionality firewall particularly after new filtering or optimization becomes necessary assure required security. Generating random traffic test matching is inefficient inaccurate it requires an exponential number cases a reasonable coverage. In addition, in most policies used during limited manually generated representing fixed policy profiles. this paper, we present framework automatic enforcement using efficient generation techniques. Our two-stage architecture that provides satisfying coverage operational states. A large variety randomly according custom profiles also based on grammar access control list. Testing packets then intelligently proportional critical regions validate policies. We describe our Cisco IOS, which includes generation, capturing analyzing out put, creating detailed reports. evaluation results show automated not only achievable but offers dramatically degree confidence than manual testing.