Network firewall policy configuration facilitation
View Patent ↗Systems for providing information on network firewall policy configuration facilitation include a firewall facilitation coordinator configured to receive a request to add an application not currently supported by a user's firewall policy, and to generate a time window during which a user can run the application and observe which types of packets are utilized by the application. A policy modification agent associated with the firewall is configured to communicate with the firewall facilitation coordinator. The policy modification agent is further configured to receive a firewall modification request from the firewall facilitation coordinator, to accomplish the observation of packets flowing through the firewall during the time window, and to subsequently modify the user's firewall policy such that the application is able to communicate as needed through the firewall, rather than being blocked. Other systems and methods are also provided.
1. A method for modifying a firewall policy of a firewall, the method comprising:
receiving a first request to modify the firewall policy to allow packets associated with a new application to pass through the firewall without being blocked;
categorizing, by a processor, each of the packets associated with the new application as questionable or acceptable;
modifying, by the processor, the firewall policy to allow the packets categorized as acceptable to pass through the firewall unblocked;
excluding, by the processor, the packets categorized as questionable from modification of the firewall policy such that the questionable packets are blocked from passing through the firewall;
receiving a second request to modify the firewall policy to allow the packets associated with the new application to pass through the firewall without being blocked; and
further modifying, by the processor, the firewall policy to allow at least a portion of the questionable packets previously blocked to pass through the firewall unblocked.
2. The method of claim 1 , further comprising categorizing the questionable packets into groups based on a type associated with each of the questionable packets.
3. The method of claim 2 , further comprising prioritizing each of the groups of the questionable packets based on a likelihood that modifying the firewall policy to allow the groups to pass through the firewall unblocked will be required in order for the new application to function properly.
4. The method of claim 3 , further comprising:
receiving a second request to modify the firewall policy to allow the packets associated with the new application to pass through the firewall without being blocked; and
in response to the second request, modifying the firewall policy to allow the group of the questionable packets associated with a highest priority to pass through the firewall unblocked.
5. The method of claim 3 , further comprising:
receiving further requests to modify the firewall policy to allow the packets associated with the new application to pass through the firewall without being blocked; and
in response to each of the further requests, modifying the firewall policy to allow the group of the questionable packets associated with a next highest priority to pass through the firewall unblocked.
6. The method of claim 5 , wherein the firewall policy is modified to allow the group of the questionable packets associated with a next highest priority to pass through the firewall unblocked until either the new application functions properly or until a threshold number of modifications is reached.
7. The method of claim 5 , wherein modifying the firewall policy to allow the group of the questionable packets associated with a next highest priority to pass through the firewall unblocked further includes modifying the firewall policy to block the group of the questionable packets previously allowed to pass through the firewall unblocked.
8. A non-transitory computer-readable storage medium having computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:
receive a first request to modify the firewall policy to allow packets associated with a new application to pass through the firewall without being blocked;
categorize each of the packets associated with the new application as questionable or acceptable;
modify the firewall policy to allow the packets categorized as acceptable to pass through the firewall unblocked;
exclude the packets categorized as questionable from modification of the firewall policy such that the questionable packets are blocked from passing through the firewall;
receive a second request to modify the firewall policy to allow the packets associated with the new application to pass through the firewall without being blocked; and
modify further the firewall policy to allow at least a portion of the questionable packets previously blocked to pass through the firewall unblocked.
9. The non-transitory computer-readable storage medium of claim 8 having further computer-executable instructions stored thereon which, when executed by a computer, cause the computer to categorize the questionable packets into groups based on a type associated with each of the questionable packets.
10. The non-transitory computer-readable storage medium of claim 9 having further computer-executable instructions stored thereon which, when executed by a computer, cause the computer to prioritize each of the groups of the questionable packets based on a likelihood that modifying the firewall policy to allow the groups to pass through the firewall unblocked will be required in order for the new application to function properly.
11. The non-transitory computer-readable storage medium of claim 10 having further computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:
receive a second request to modify the firewall policy to allow the packets associated with the new application to pass through the firewall without being blocked; and
in response to the second request, modify the firewall policy to allow the group of the questionable packets associated with a highest priority to pass through the firewall unblocked.
12. The non-transitory computer-readable storage medium of claim 10 having further computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:
receive further requests to modify the firewall policy to allow the packets associated with the new application to pass through the firewall without being blocked; and
in response to each of the further requests, modify the firewall policy to allow the group of the questionable packets associated with a next highest priority to pass through the firewall unblocked.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the firewall policy is modified to allow the group of the questionable packets associated with a next highest priority to pass through the firewall unblocked until either the new application functions properly or until a threshold number of modifications is reached.
14. The non-transitory computer-readable storage medium of claim 12 having further computer-executable instructions stored thereon which, when executed by a computer, cause the computer to modify the firewall policy to block the group of the questionable packets previously allowed to pass through the firewall unblocked when the firewall policy is modified to allow the group of the questionable packets associated with the next highest priority to pass through the firewall unblocked.
15. A method for modifying a firewall policy of a firewall, the method comprising:
receiving a request to modify the firewall policy to incorporate filtering rules to allow packets associated with a new application to pass through the firewall without being blocked;
providing, by a processing device, a first request for a time window during which the new application can be exercised without being blocked by the firewall;
receiving an indication that the first request for a time window is unacceptable;
in response to receiving the indication, accessing, by the processing device, at least one previously accepted time window request to determine at least one time window already scheduled; and
providing, by the processing device, a second request for a time window based on the at least one previously accepted time window request such that the second request for a time window avoids the at least one time window already scheduled.
16. The method of claim 15 , further comprising:
determining a number of attempts associated with requesting a time window; and
if the number of attempts is at least equal to a threshold number of attempts, then providing an inquiry to determine whether to continue requesting a time window.
17. The method of claim 15 , wherein the request to modify the firewall policy includes information regarding an available time for the time window and wherein providing a request for a time window includes providing the request based on the information regarding the available time.
18. The method of claim 15 , further comprising:
if the second request for a time window is accepted, categorizing each of the packets associated with the new application as questionable or acceptable as the packets traverse to/from the firewall during the time window;
modifying the firewall policy to allow the packets categorized as acceptable to pass through the firewall unblocked; and
excluding the packets categorized as questionable from modification of the firewall policy such that the questionable packets are blocked from passing through the firewall.