Clean up Rule in Firewall

Structural redundancy does not require additional data and is based on the identification of rules covered by other rules and having the same action (redundant rules) or the opposite action (shaded rules). In any case, a redundant or shaded rule is a candidate for elimination. Over time, new technologies emerge that require constant updates of firewall rules. Due to the availability of new technologies, firewall administrators are inundated with new firewall changes. Administrators need time and resources to analyze these new change requests and determine the best course of action for security practices. This time constraint and lack of resources can lead to outdated, unused or overly permissive rules. Firewall performance may be affected, which can lead to an increase in malicious attacks. Reuven Harrison is CTO of firewall management provider Tufin Technologies, one of the vendors whose product has been tested in Network World Review. With the help of some of its customers, Harrison has compiled a list of best practices for cleaning up a firewall (or router) rule base. Practices apply regardless of whether you use a firewall management tool or not, but it`s obviously easier to perform the tasks and get good results if you have a tool to automate these activities. The analysis of the configurations of some firewalls, not to mention the hundreds, has grown beyond human computing capacity. That`s why a new class of products, some of which have recently been tested by Network World, is becoming increasingly popular to help network administrators detect configuration errors, avoid conflicting rules, identify vulnerabilities, and meet audit and compliance requirements. In a May 2010 CSO article, Neil Roiter wrote, “Firewall audit tools automate the otherwise nearly impossible task of analyzing complex and inflated rule sets to examine and demonstrate enterprise access controls and configuration change management processes.” Even if you have few firewalls, they may contain some or all of the outdated or expired rules, or overlap or eclipse if they have been in place for several years.

However, establishing secret rules is not a trivial task. The size and complexity of a typical corporate firewall makes it very difficult to manually analyze the firewall rule base. Many organizations rely on automated firewall policy analysis tools to support accurate and complete identification, turning this tedious process into a simple one. They often contain rules that are partially or completely outdated, expired or shaded. The problem gets even worse if many administrators make adjustments or if your organization has a large number of firewalls. Log usage analysis identifies rules and objects that can be eliminated based on zero usage because they are analyzed using log data. Firewall management tools typically use log data files to use log data that you can use to generate reports and cleanup scripts. In addition to redundant and shaded rules, you should also find rules that cause redundancy, unreferenced objects, inactive rules, disabled rules.

You can use an automated firewall management tool to perform a structural redundancy analysis to determine redundancy rules. Automated tools help you create a report or even a cleanup script. Over time, firewall rule bases tend to become large and complicated. Not so long ago, 200 to 300 rules were considered exaggerated. Now, it`s not uncommon for firewalls to have several hundred or even thousands of rules, many of which became obsolete when IT operations added new rules to meet business needs, but failed to remove old ones. A firewall rule base is a set of rules that determine what is allowed by the firewall and what is not. Therefore, to optimize firewall performance, you must identify redundant, duplicated, obsolete, unused, and shaded rules and remove them from the firewall policy base. Thousands of rules and objects that have accumulated in your firewalls over the years and are now obsolete can cause a number of problems. However, deleting rules is not easy as it can lead to application interruptions. Each firewall has a built-in reporting tool with detailed information about your traffic. This tool allows you to monitor logs for changes or anomalies that may involve changes to your firewall settings.