As firewall engineers, we all have an intuitive sense for how complex a given firewall configuration is. We see it in the size of the ruleset. We see it in the errors that we know are there but don’t have time to track down. We see it in the amount of hair-pulling in involved in making sure a simple change is correct. (From my photo in the sidebar, you can tell I’ve seen my share of complex firewalls!) But what exactly is it about a given firewall configuration can make it so complex and difficult to manage?
Here at Athena Security, we felt there must be a way to identify the factors that really contribute to firewall complexity and quantify them. We have accumulated a large database of firewall configurations from companies in a wide variety of industries, including financial services, health care, construction, human resources, manufacturing, IT services, and network security. These configurations were manually assessed for a firewall administrator’s “intuitive” sense of complexity and then analyzed using Athena FirePAC to identify configuration errors and policy risks. These results were subjected to intensive statistical analysis to find correlations between different aspects of the configurations that might contribute to complexity.
After evaluating over 100 firewall configurations, we found twelve factors that correlate strongly with our intuitive sense of complexity. These factors include obvious items like the number of ACLs and NATs in the ruleset. Large rulesets are clearly more difficult to understand and maintain, and thus more complex. But we also found that certain structural elements correlate strongly with complexity, including the number of discrete address elements (individual IP addresses, subnets, or address ranges), rules that have a wildcard match for source, destination, or service, and rules with a deny action. These factors all cause complex interactions between the rules, magnifying the complexity of even small rulesets.
Based on the results of this study, we have developed a tool, called Firewall Grader, to measure these factors in Cisco, Checkpoint, or Juniper Netscreen firewall configurations. It derives a complexity metric for the firewall based on the assessment of all twelve factors and generates a report of the findings. We have found the metric useful in identifying those firewalls that are most difficult to manage or to audit. Tracking the complexity metric over time can help you ensure that your firewall configurations don’t get out of control. It will also recommend ways to restructure the configuration to reduce overall complexity.
Firewall Grader is available as a free download from our web site. Try it out! Let us know what you think.