Firewall rule and data flow analysis and modification
One embodiment includes retrieving firewall flow log data that indicates whether a flow was allowed or denied, an identifier of a rule that allowed or denied the flow, a source port, a protocol, a destination port, a source IP or FQDN, and a destination IP or FQDN. The method continues with processing the firewall flow log data, such as by identifying and counting occurrences of unique flows and counting flows allowed or denied by each rule. The method further includes generating a recommendation of at least one of limiting an existing rule, deleting an existing rule, and modifying rule application precedence. The recommendation may be generated based on at least one of the occurrences of unique flows and counted flows allowed or denied by each rule of a rule base. This method also includes providing the recommendation within a user interface as a selectable option for implementation.
1. A method comprising:
retrieving firewall flow log data from a configurable time period and from a plurality of firewalls, each firewall associated with a firewall identifier of firewall identifiers, the firewall flow log data including data indicating whether a flow was allowed or denied, an identifier of a rule that allowed or denied the flow, and a five-tuple for the flow including a source port, a protocol, a destination port, a source IP or Fully Qualified Domain Name (FQDN), and a destination IP or FQDN;
processing the firewall flow log data, the processing including:
identifying and counting occurrences of unique flows, each unique flow corresponding to a unique five-tuple; and
counting the unique flows allowed or denied by each rule;
generating, based on at least one of the occurrences of unique flows and counted unique flows allowed or denied by each rule of a rule base associated with a subject firewall identifier of the firewall identifiers, a recommendation including limiting an existing rule to allow or deny fewer five-tuple values;
providing the recommendation within a user interface as a selectable option for implementation; and
changing, responsive to the selectable option being selected, the existing rule of the associated subject firewall to allow or deny fewer five-tuple values.
2. The method of claim 1 , wherein:
the recommendation further includes a recommendation to modify a rule application precedence, the recommendation is generated by:
ordering rules in the rule base in descending order from a highest count of flows allowed or denied by a rule;
comparing the ordered rules with a current firewall rule application precedence configuration;
identifying a rule in the ordered rules that has a different location in the ordered rules than in the current firewall rule application precedence configuration; and
generating the recommendation for at least one rule to modify rule application precedence of the firewall rule application precedence configuration.
3. The method of claim 1 , wherein the recommendation further includes a recommendation to delete an existing rule is identified when an existing rule has not been applied to allow or deny a flow for a configurable period.
4. The method of claim 1 , wherein the recommendation further includes a recommendation to limit an existing rule and the recommendation is identified by:
identifying rules with allowance configurations that have been applied to allow flows to a number of source ports, protocols, destination ports, source IPs or FQDNs, and destination IPs or FQDNs; and
generating a recommendation to change the identified rules to only allow fewer unique flows.
5. The method of claim 1 , wherein the method is performed in response to selection of a rule and the method is performed only with regard to the selected rule such that the firewall flow log data is retrieved only for flows allowed or denied by the selected rule.
6. The method of claim 1 , wherein the user interface is a dataset renderable on a user device.
7. The method of claim 1 , wherein the firewalls of the computing environment are deployed as software on virtual machines.
8. A method comprising:
presenting, in a user interface, a list of rules defined on a firewall that instruct the firewall on whether to allow or deny a specific packet of data, each rule including a property to allow or deny data and a 5-tuple data including a source port, a protocol, a destination port, a source IP or FQDN, and a destination IP or FQDN;
receiving, by the user interface, a selection of a rule included in the presented list of rules upon which to perform analysis;
retrieving firewall flow log data associated with the selected rule, the firewall flow log data from a configurable time period and from a plurality of firewalls, each firewall associated with a firewall identifier of firewall identifiers, the data of a flow included in the firewall flow log data including data indicating whether the flow was allowed or denied, an identifier of the select rule that allowed or denied the flow, and corresponding 5-tuple data;
processing the firewall flow log data, the processing including identifying and counting occurrences of unique flows allowed or denied by the selected rule, the unique flows corresponding to unique 5-tuple values;
generating, based on at least one of the occurrences of unique flows and counted flows allowed or denied by the selected rule associated with a subject firewall identifier of the firewall identifiers, a recommendation including limiting allowances or denials of the selected rule to fewer 5-tuple values;
updating the user interface to include a view of the processed firewall flow log data and selectable user interface items for each of the generated recommendations, the selection of which generates a system command to implement the selected recommendation on the firewall; and
changing, responsive to the selection of a user interface item of the user interface items associated with a recommendation, the selected rule of the associated subject firewall to allow or deny fewer five-tuple values.
9. The method of claim 8 , wherein the 5-tuple is extendable to include a range of at least one of IPs, ports, and protocols.
10. The method of claim 8 , wherein the user interface is a dataset renderable on a user device.
11. The method of claim 8 , wherein:
the recommendation includes a recommendation to modify a rule application precedence and the recommendation is generated by:
ordering rules in the rule base in descending order from a highest count of flows allowed or denied by a rule;
comparing a location of the selected rule in the ordered rules with a location of the selected rule in a current firewall rule application precedence configuration; and
generating the recommendation for the selected rule to modify the current firewall rule application precedence configuration to more closely match the ordered rules.
12. The method of claim 8 , wherein the recommendation further includes a recommendation to delete or deactivate the selected rule and the recommendation is identified when the selected rule has not been applied to allow or deny a flow for a certain period.
13. The method of claim 8 , wherein the recommendation to limit the selected rule is identified by:
identifying an allowance configuration of the selected rule that has been applied to allow flows to a number of source ports, protocols, destination ports, source IPs or FQDNs, and destination IPs or FQDNs; and
generating the recommendation to change the selected rule to allow fewer unique flows.
14. A system comprising:
a processor;
a network interface device; and
a memory storing instructions executable by the processor to perform data processing activities comprising:
generating user interface data renderable on a user device as a user interface to present a list of rules defined on a firewall that instruct the firewall on whether to allow or deny a specific packet of data, each rule including a property to allow or deny data based on a 5-tuple including a source port, a protocol, a destination port, a source IP or FQDN, and a destination IP or FQDN;
transmitting the user interface data to a user device via the network interface device;
receiving, via the network interface device, a selection of a rule included in the presented user interface upon which to perform analysis;
retrieving, via the network interface device, firewall flow log data associated with the selected rule, the firewall flow log data from a configurable time period and from a plurality of firewalls, each firewall associated with a firewall identifier of firewall identifiers, the data of a flow including data indicating whether the flow was allowed or denied, an identifier of the select rule that allowed or denied the flow, and 5-tuple data;
processing the firewall flow log data, the processing including identifying and counting occurrences of unique flows by unique allowed or denied by the selected rule, the unique flows corresponding to unique 5-tuple values;
generating, based on at least one of the occurrences of unique flows and counted flows allowed or denied by the selected rule associated with a subject firewall identifier of the firewall identifiers, a recommendation including limiting allowances or denials of the selected rule to fewer 5-tuple values; and
updating the user interface data, by transmitting further user interface data via the network interface device to the user device, to render a view of the processed firewall flow log data and selectable user interface items for each of the generated recommendations, the selection of which generates a system command to implement the selected recommendation on the firewall; and
changing, responsive to the selection of a user interface item of the user interface items associated with a recommendation, the selected rule of the associated subject firewall to allow or deny fewer five-tuple values.
15. The system of claim 14 , wherein the 5-tuple is extendable to include a range of at least one of IPs, ports, and protocols.
16. The system of claim 14 , wherein the user interface data is renderable within a web browser of the user device.
17. The system of claim 14 , wherein:
the recommendation further includes a recommendation to modify rule application precedence, the recommendation is generated by:
ordering rules in the rule base in descending order from a highest count of flows allowed or denied by a rule;
comparing a location of the selected rule in the ordered rules with a location of the selected rule in a current firewall rule application precedence configuration; and
generating the recommendation for the selected rule to modify the current firewall rule application precedence configuration to more closely match the ordered rules.
18. The system of claim 14 , wherein the recommendation further includes a recommendation to delete or deactivate the selected rule when the selected rule has not been applied to allow or deny a flow for a certain period.
19. The system of claim 14 , wherein the recommendation to limit the selected rule is identified by:
identifying an allowance configuration of the selected rule that has been applied to allow flows to a number of source ports, protocols, destination ports, source IPs, and destination IPs; and
generating a recommendation to change the selected rule to only allow flows more closely limited to those involving fewer unique 5-tuple values.