2012 IEEE/IPSJ 12th International Symposium on Applications and the Internet (2005)
Jan. 31, 2005 to Feb. 4, 2005
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/SAINT.2005.28
Pavan Verma , University of Michigan, Ann Arbor, MI
Atul Prakash , University of Michigan, Ann Arbor, MI
Firewalls play a critical role in protecting networks and enforcing security policies. Traditionally, firewalls have been deployed at an organization's periphery to protect it from Internet traffic. Today, however, this model no longer holds true as organizations try to safeguard themselves against other types of threats. This has led to the advent of the distributed firewall where potentially every router or end-host can run a firewall. As it is, firewalls are extremely hard to analyze and configure correctly due to complexities of network topology, routing, and administrative issues. Distributed firewalls make the situation even worse since there are multiple firewalls. This paper describes FACE - a tool that helps in analysis and configuration of distributed firewalls. Using FACE, administrators can automatically generate and analyze configurations for all firewalls in the network by specifying the filtering policy and a threat model in which a distributed firewall must provide defense against spoofed traffic from specified nodes in a network.
Pavan Verma, Atul Prakash, "FACE: A Firewall Analysis and Configuration Engine", 2012 IEEE/IPSJ 12th International Symposium on Applications and the Internet, vol. 00, no. , pp. 74-81, 2005, doi:10.1109/SAINT.2005.28